CVE-2026-73597 in Secure Connect Gateway Policy Manager
Summary
by MITRE • 09/29/2026
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Cross-Site Request Forgery (CSRF) vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure, Information tampering, Launch of phishing attacks, and Protection mechanism bypass.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/29/2026
The Dell Secure Connect Gateway Policy Manager, specifically in versions prior to 5.34.00.16, suffers from a critical Cross-Site Request Forgery vulnerability that fundamentally undermines the integrity of administrative actions performed through its web interface. This flaw arises because the application fails to implement adequate anti-CSRF mechanisms, such as unique per-session tokens or strict validation of the Origin and Referer headers for state-changing HTTP requests. Consequently, an attacker who can trick a legitimate administrator into visiting a malicious webpage while authenticated to the Policy Manager console could force their browser to submit unintended commands to the gateway's backend systems without the user's knowledge or consent.
The technical nature of this vulnerability allows for unauthenticated exploitation in scenarios where session cookies are not configured with appropriate security flags, such as HttpOnly or SameSite attributes that would prevent cross-origin submission. By crafting a malicious HTML page containing hidden forms or JavaScript-driven requests targeting specific administrative endpoints, an attacker can manipulate the authenticated state of the victim's browser. This bypasses standard access controls because the server processes the request based on the valid session cookie present in the user’s browser, assuming it represents a legitimate action initiated by that user rather than a forged request from a third-party domain.
The operational impact of this vulnerability is severe and multifaceted, encompassing information disclosure, data tampering, phishing facilitation, and protection mechanism bypass. An attacker could exploit this flaw to exfiltrate sensitive configuration details or network topology information stored within the Policy Manager database by forcing requests that return such data in response bodies visible to the malicious site via JavaScript if cross-origin resource sharing policies are misconfigured. Furthermore, the ability to tamper with configurations allows an adversary to alter firewall rules, modify access control lists, or disable security logging features, thereby degrading the overall security posture of the protected network infrastructure and potentially creating backdoors for persistent unauthorized access.
Beyond direct system manipulation, this vulnerability serves as a vector for launching sophisticated phishing attacks against internal users. By altering administrative settings to redirect traffic or inject malicious content into legitimate web pages proxied through the gateway, an attacker can compromise user credentials or distribute malware under the guise of trusted applications. Additionally, by bypassing protection mechanisms such as rate limiting or multi-factor authentication prompts if those are managed within the Policy Manager scope, the attacker gains a foothold that is significantly harder to detect and remediate using standard security monitoring tools.
To mitigate this risk, organizations must immediately upgrade Dell Secure Connect Gateway Policy Manager to version 5.34.00.16 or later, where these CSRF protections have been implemented through robust token-based validation for all state-changing operations. In the interim, if upgrading is not immediately feasible, administrators should restrict access to the Management interface exclusively via trusted IP addresses using network-level firewalls and ensure that session cookies are configured with strict SameSite attributes set to Strict or Lax to prevent cross-site submission of credentials. Regular auditing of administrative logs for unusual request patterns can also help in early detection of exploitation attempts targeting this specific weakness.
From a classification perspective, this vulnerability aligns with CWE-352 Cross-Site Request Forgery and is associated with MITRE ATT&CK technique T1078 Valid Accounts when leveraged to maintain persistence or escalate privileges through administrative abuse. The lack of proper validation for the source of requests represents a fundamental failure in input verification relative to session management, highlighting the necessity of implementing defense-in-depth strategies that include both server-side token generation and client-side security headers to prevent such forgery attacks effectively.