CVE-2026-73591 in Secure Connect Gateway Policy Manager
Summary
by MITRE • 09/23/2026
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Inclusion of Sensitive Information in Source Code vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information exposure.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/23/2026
The Dell Secure Connect Gateway (SCG) Policy Manager software, specifically versions prior to 5.34.00.16, contains a critical security flaw classified as an Inclusion of Sensitive Information in Source Code vulnerability. This issue arises from the improper handling or exposure of confidential data within the application's source code structure or associated configuration files that are accessible during normal operation or through specific administrative interfaces. The presence of sensitive information such as credentials, API keys, internal network topology details, or cryptographic secrets embedded directly in the codebase represents a fundamental deviation from secure coding practices and industry standards for software development life cycles.
From a technical perspective, this vulnerability allows an unauthenticated attacker with remote access to retrieve these exposed artifacts without needing valid user credentials. The exploitation mechanism typically involves querying specific endpoints or accessing static files that inadvertently contain hardcoded secrets or configuration data intended only for internal system use. By leveraging standard web request techniques or directory traversal methods if applicable, the adversary can extract this information, which serves as a significant foothold for further malicious activities. This aligns with CWE-200, which defines Information Exposure as an intentional or unintentional disclosure of information to actors not explicitly authorized to have access to that information.
The operational impact of this vulnerability is severe due to the potential for cascading attacks. Once sensitive data such as administrative passwords or service account tokens are obtained, attackers can use them to authenticate into other systems within the enterprise network, escalate privileges, or manipulate policy configurations on the Secure Connect Gateway itself. This compromises the integrity and confidentiality of the entire secure access infrastructure managed by Dell SCG. The exposure undermines trust in the security controls provided by the gateway, potentially allowing unauthorized users to bypass authentication mechanisms or intercept sensitive traffic that should be encrypted and protected.
This vulnerability is also associated with MITRE ATT&CK technique T1087, Account Discovery, as obtaining credentials facilitates lateral movement and persistence within a compromised environment. Furthermore, it relates to T1539, Steal Web Session Cookie, if session tokens are exposed, or more broadly to Initial Access vectors where stolen secrets are used to gain entry into protected systems. The lack of authentication required for exploitation makes this particularly dangerous in environments where the SCG interface is accessible from untrusted networks or has been improperly segmented.
To mitigate this risk, organizations running Dell Secure Connect Gateway Policy Manager versions prior to 5.34.00.16 must immediately apply the vendor-recommended patch that addresses this source code exposure issue. It is critical to verify the integrity of the installed version and ensure that all updates are applied promptly from official channels. In addition to updating, administrators should conduct a thorough audit of their deployment configurations to identify any other instances where sensitive data might be hardcoded or improperly exposed in logs, configuration files, or API responses. Implementing strict access controls for administrative interfaces and regularly rotating credentials can further reduce the attack surface while patching efforts are underway.