CVE-2026-73595 is a medium severity (CVSS 4.7) download of code without an integrity check in Dell Secure Connect Gateway Policy Manager. The record lists versions prior to 5.34.00.16 and prior to 5.36. Apply the update described in Dell advisory DSA-2026-385.
What's affected
Dell Secure Connect Gateway (SCG) Policy Manager. The record says versions prior to 5.34.00.16, and versions prior to 5.36. I read this as two release lines, each with its own fixed build, but Dell's page refused my automated request, so confirm the mapping in the advisory.
The record says an unauthenticated attacker with remote access could potentially reach code execution, information disclosure, information tampering and protection mechanism bypass. The score is only 4.7 because the vector has high attack complexity and needs user interaction.
How to check if you're exposed
In the Policy Manager console, find the product version and compare it with the advisory. Keep a list of every Secure Connect Gateway component in your estate, since the advisory covers several issues.
Also check whether the system's management interface is reachable from untrusted networks.
What to do now
- Read Dell advisory DSA-2026-385 and note the fixed release for your line.
- Update Policy Manager to the fixed release.
- Restrict network access to the gateway to trusted management networks.
- Check that updates it downloads come from sources you expect.
- Review other issues in the same advisory, which is titled as covering multiple vulnerabilities.
Why it matters
The record maps this to CWE-494, download of code without integrity check. Software that fetches code or updates from somewhere must verify them, usually with a signature, before running them. Without that check, anyone who can alter the download path, or answer in place of the real source, gets to choose what runs.
The medium score reflects the vector, which has high attack complexity and needs user interaction. Even so, a management gateway has trusted standing in the environment, so a lower score does not mean it can wait indefinitely. The KEV flag is false.
Quick check
Is CVE-2026-73595 critical?
No. The record gives CVSS 4.7, which is medium. It still deserves a routine patch.
Sources
Last reviewed: 19 October 2026.
