CVE-2026-73599 Overview
CVE-2026-73599 is an open redirect vulnerability [CWE-601] in Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16. The flaw allows an unauthenticated remote attacker to redirect users to attacker-controlled destinations and pivot the weakness into server-side request forgery (SSRF). Exploitation requires user interaction, such as clicking a crafted link. Dell addressed the issue in security advisory DSA-2026-385.
Critical Impact
An unauthenticated attacker can abuse URL redirection in SCG Policy Manager to trigger SSRF, enabling reconnaissance of internal services and abuse of trust boundaries between the gateway and back-end systems.
Affected Products
- Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16
Discovery Timeline
- 2026-09-29 - CVE-2026-73599 published to the National Vulnerability Database (NVD)
- 2026-09-29 - Last updated in NVD database
Technical Details for CVE-2026-73599
Vulnerability Analysis
The vulnerability is a URL Redirection to Untrusted Site issue (open redirect) in Dell Secure Connect Gateway Policy Manager. The application accepts a user-supplied URL parameter and forwards the client without validating that the destination belongs to a trusted domain. An attacker can craft a link that appears to originate from the legitimate SCG Policy Manager host but sends the victim to a malicious site or causes the server to issue outbound requests to attacker-chosen targets.
Because the redirect target can be leveraged to coerce the server into initiating requests, the flaw escalates to server-side request forgery. SSRF against a management appliance such as SCG Policy Manager can expose internal services, metadata endpoints, and adjacent management planes that are not otherwise reachable from the network perimeter.
Root Cause
The root cause is missing or insufficient validation of a redirect URL parameter processed by the Policy Manager web layer. The application trusts client-controlled input to build a redirect or outbound request destination without enforcing an allow-list of hostnames or verifying that the target is within the application's own origin.
Attack Vector
Exploitation is network-based and does not require authentication, but does require the victim to interact with a crafted link. A typical attack chain includes distributing a phishing message that references the legitimate SCG Policy Manager URL with an embedded redirect parameter. When the victim follows the link, the gateway either redirects them to an attacker-controlled site for credential harvesting or issues a server-side HTTP request to an internal target selected by the attacker.
No verified public proof-of-concept is available. See the Dell Security Update DSA-2026-385 advisory for vendor technical details.
Detection Methods for CVE-2026-73599
Indicators of Compromise
- Web server or reverse proxy logs showing requests to SCG Policy Manager endpoints containing external URLs in redirect parameters (for example, values beginning with http:// or https:// pointing to non-Dell domains).
- Outbound HTTP or HTTPS connections from the SCG Policy Manager host to internal-only IP ranges, cloud metadata endpoints such as 169.254.169.254, or unexpected external destinations.
- User reports of links that visually reference the SCG Policy Manager hostname but land on unrelated third-party sites.
Detection Strategies
- Inspect HTTP access logs for query parameters carrying fully qualified URLs and flag values whose hostnames fall outside an approved allow-list.
- Correlate inbound requests to the Policy Manager with subsequent outbound requests from the same host to detect SSRF-style behavior.
- Deploy web application firewall rules that identify open-redirect payload patterns targeting SCG Policy Manager URI paths.
Monitoring Recommendations
- Forward SCG Policy Manager application and proxy logs to a central analytics platform and alert on redirect parameters resolving to non-corporate domains.
- Monitor egress traffic from the management VLAN hosting SCG Policy Manager for connections to internal service ports that the gateway should not initiate.
- Track user click-through telemetry from email security gateways for links referencing the SCG Policy Manager hostname combined with redirect query strings.
How to Mitigate CVE-2026-73599
Immediate Actions Required
- Upgrade Dell Secure Connect Gateway Policy Manager to version 5.34.00.16 or later as directed in DSA-2026-385.
- Restrict network access to the SCG Policy Manager management interface to trusted administrative networks only.
- Review recent access logs for redirect parameter abuse and unexpected outbound requests originating from the appliance.
Patch Information
Dell has released a fixed build in Secure Connect Gateway Policy Manager version 5.34.00.16. Refer to Dell Security Update DSA-2026-385 for upgrade instructions and the full list of addressed vulnerabilities.
Workarounds
- Place the SCG Policy Manager behind a reverse proxy or web application firewall that strips or validates redirect parameters against an allow-list of internal hostnames.
- Apply egress filtering on the appliance to block outbound connections to internal management ranges and cloud metadata addresses until the patch is deployed.
- Educate administrators and users to inspect the full destination of SCG Policy Manager URLs before clicking, particularly links delivered via email.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
