CVE-2026-73599 in Secure Connect Gateway Policy Manager
Summary
by MITRE • 09/29/2026
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an URL Redirection to Untrusted Site ('Open Redirect') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Server-side request forgery.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/29/2026
The Dell Secure Connect Gateway Policy Manager software, specifically versions prior to 5.34.00.16, is susceptible to an open redirect vulnerability that facilitates server-side request forgery attacks. This security flaw resides within the URL redirection logic of the application's web interface, where user-supplied input is not adequately validated before being used as a destination for HTTP redirects. The vulnerability allows an unauthenticated attacker with remote network access to manipulate the redirect parameter in such a way that the victim browser or proxy is directed to a malicious domain controlled by the attacker rather than the intended legitimate resource within the Dell Secure Connect Gateway environment.
From a technical perspective, this flaw represents a classic instance of CWE-601, which defines URL Redirection to Untrusted Site ('Open Redirect'). The underlying mechanism involves the application accepting external input for redirection targets without performing sufficient checks against an allowlist or verifying that the target domain matches expected internal hosts. When the server processes these requests, it issues HTTP status codes such as 302 Found along with a Location header pointing to the attacker-controlled URL. This behavior is particularly dangerous because browsers and many security tools trust redirects originating from trusted domains, assuming the content at the redirect destination is safe or legitimate due to its association with the original domain.
The operational impact of this vulnerability extends beyond simple phishing capabilities. By leveraging the open redirect, an attacker can facilitate server-side request forgery (SSRF) scenarios where the victim's browser acts as a proxy for malicious requests. This can be used in conjunction with other attack vectors to bypass authentication mechanisms that rely on referer headers or origin checks, potentially allowing unauthorized access to internal administrative interfaces if combined with session hijacking techniques. Furthermore, this vulnerability enables sophisticated phishing campaigns where attackers create links that appear to originate from the legitimate Dell Secure Connect Gateway domain, thereby increasing the likelihood of user trust and credential theft through deceptive login pages hosted on external servers.
In terms of industry classification frameworks, this vulnerability aligns with MITRE ATT&CK technique T1566.002, which covers Spearphishing Link attacks under Initial Access. The ability to redirect users from a trusted source to an untrusted site is a primary enabler for these initial access strategies. Additionally, the potential for SSRF relates to techniques involving internal network discovery and exploitation of backend services that may be accessible only from specific internal networks but can be triggered via redirected requests from compromised or manipulated client sessions.
To mitigate this risk, organizations running Dell Secure Connect Gateway Policy Manager versions prior to 5.34.00.16 must apply the vendor-provided security patch immediately upon availability. The update addresses the input validation deficiencies that allow untrusted redirection targets. In addition to upgrading software, administrators should implement web application firewall rules that detect and block abnormal redirect patterns or unauthorized domain names in URL parameters. It is also advisable to enforce strict Content Security Policy headers where possible to limit navigation destinations and to monitor access logs for unusual redirect activity originating from the policy manager interface. Regular security assessments and penetration testing focused on input validation flaws are recommended to identify similar weaknesses across other web-facing components of the infrastructure.