CVE-2026-73597 is a cross-site request forgery flaw (CWE-352) in Dell Secure Connect Gateway Policy Manager. A remote attacker could cause an authenticated user's browser to submit actions. The record rates it Medium at 6.5. Apply the update from Dell advisory DSA-2026-385.
What's affected
The record says Dell Secure Connect Gateway Policy Manager versions prior to 5.34.00.16 are affected. Dell's advisory page returned an access denied message when we fetched it, so we rely on the record for the version number. Read DSA-2026-385 to confirm the fix for your release.
The vector uses network access, low complexity and no privileges, with low impact on confidentiality and integrity. The record lists information disclosure, tampering, launching phishing attacks and bypassing protection mechanisms as consequences. The same advisory also covers the certificate validation flaw in CVE-2026-73594, so one update addresses both.
How to check if you're exposed
Dell appliances and management software are checked through their own interfaces, not through a package manager. Open the administration console of the product and read the version on the About or System page, then compare it with the versions in the Dell advisory.
For a fleet, ask the team that owns the product for an inventory of versions, and record it somewhere central. If you track software in an inventory or SBOM, add the product and version so that the next advisory is a lookup.
What to do now
- Open Dell advisory DSA-2026-385 and confirm the fixed version.
- Update the Policy Manager to 5.34.00.16 or later, as the record indicates, following Dell's steps.
- Use a separate browser profile for administration consoles, and sign out when finished.
- Do not browse the web or open email links in the same session as an admin console.
- Restrict network access to the console to administrators.
Why it matters
The weakness is cross-site request forgery, CWE-352. A web console trusts requests that arrive with the user's session cookie. If the application does not also check that the request was intended, for example with an anti-forgery token, a hostile web page can cause the browser to send one. The user's own login supplies the authority.
The risk grows with what the console can do. For a policy manager, a forged request might change settings that other systems rely on. Defenders cannot fix the code, but can reduce the chance: keep admin sessions short, keep them separate from general browsing, and apply the vendor fix. KEV status is false.
Quick check
Does this need the attacker to log in?
No account is needed. The attacker relies on a logged in administrator opening a hostile page.
Is this fixed by the same update as CVE-2026-73594?
Both are in the same Dell advisory. Confirm the exact fixed version there.
Sources
Last reviewed: 18 October 2026.
