CVE-2026-78027
Dell Policy Manager For Secure Connect Gateway: server-side request forgery can lead to information disclosure
- Risk score
- 42/100
- CVSS
- 6.8 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 9 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Server-Side Request Forgery (SSRF) vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure and Server-side request forgery.
- Affected
- Dell Policy Manager For Secure Connect Gateway before 5.34.00.16
- Fix
- Upgrade Dell Policy Manager For Secure Connect Gateway to 5.34.00.16 or later.
- Exploitation
- No known exploitation
Story map
At a glance
Dell Policy Manager For Secure Connect Gateway: Amber, patch this week. Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Restriction of Excessive Authentication Attempts vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges, Protection mechanism bypa…
The flaws
- CVE-2026-78027: Server-side request forgery can lead to information disclosure (CVSS 6.8 · EPSS 0%)
- CVE-2026-76779: Privilege escalation (CVSS 9.8 · EPSS 0%)
- CVE-2026-73595: Remote code execution (CVSS 9.8 · EPSS 0%)
- CVE-2026-78020: Denial of service (CVSS 8.8 · EPSS 0%)
The fix
Upgrade Dell Policy Manager For Secure Connect Gateway: 5.34.00.16 · 5.36 or later on your release line
Who is exposed: Dell Policy Manager For Secure Connect Gateway before 5.34.00.16
Where it stands
- No known exploitation
Connects to
- Same weakness: Server-side request forgery (CWE-918). 221 other warnings in 30 days
- Same product: Earlier Dell Policy Manager For Secure Connect Gateway warnings. 23 in the last 90 days
Why it is Yellow
- CVSS 6.8 medium
References
Original description
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Server-Side Request Forgery (SSRF) vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure and Server-side request forgery.
Last activity 9 Oct 2026. Patch Forecast updates every hour.