CVE-2026-76779: Dell SCG Policy Manager Brute-Force Authentication

CVE-2026-76779 is a high severity (CVSS 7.4) flaw in Dell Secure Connect Gateway Policy Manager before 5.34.00.16. It does not limit repeated authentication attempts, so an unauthenticated remote attacker could guess their way to access. Update to 5.34.00.16 or later per Dell security advisory DSA-2026-385.

What's affected

• Product: Dell Secure Connect Gateway (SCG) Policy Manager.
• Affected: versions prior to 5.34.00.16.
• Fixed: 5.34.00.16 or later. Dell's page would not load for me, so confirm the details in DSA-2026-385.
• Weakness: CWE-307, improper restriction of excessive authentication attempts.
• CVSS 7.4 (high), vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. Not listed in CISA KEV.

How to check if you're exposed

Open the Policy Manager and read the version in its about or settings page, or ask the team that runs your Dell support tooling. Compare it with 5.34.00.16.

Then check who can reach the service. A login page that accepts unlimited guesses is only dangerous if an attacker can reach it, so find any firewall rule or proxy that exposes it beyond the admin network. Look in authentication logs for long runs of failed logins from one source.

What to do now

1. Find every Dell SCG Policy Manager instance and its version.
2. Update to 5.34.00.16 or later, following Dell advisory DSA-2026-385.
3. Limit access to the interface to administrator networks.
4. Use strong, unique passwords and enable any multi-factor option the product offers.
5. Review failed login logs, and rotate credentials if you see signs of guessing.

Why it matters

The weakness is the absence of a limit. When a login form lets someone try as many passwords as they like, the strength of the password is the only barrier, and a script can try many in little time. Dell's text lists privilege elevation, protection mechanism bypass and unauthorized access as outcomes.

The fix class is well known: lockouts or throttling, and monitoring for bursts of failures. Check any admin interface you run for the same property.

Quick check

Sources

• Dell DSA-2026-385 (page did not load usable content)

Last reviewed: 19 October 2026.