CVE-2026-78018 is a medium severity (CVSS 6.3) flaw in Dell SCG Policy Manager before 5.34.00.16. According to the record, exploitation is local and needs a low privilege account. Dell fixed it in 5.34.00.16, so check your version and update. Details are in Dell's advisory.
What's affected
Dell Secure Connect Gateway (SCG) Policy Manager, all versions before 5.34.00.16. The fix is version 5.34.00.16 or later. The record names this product and lists the fix version; Dell's advisory is DSA-2026-385, titled as a security update for Policy Manager with multiple vulnerabilities.
We could not retrieve Dell's advisory (the site returned an access denied response to our request), so the versions here come from the NVD record only. Read the advisory itself to confirm affected editions and any extra steps before you plan the change. The record does not mark the issue as exploited, and the KEV flag is false.
How to check if you're exposed
Find the version of each SCG deployment and compare it with the fixed version.
In the Policy Manager web interface, look for the version in the About or system information view. If the product runs on a server you manage, also check the installed package or application list.
Dell shows these fields in different places by release, so use the product's own documentation if the labels differ. Record each instance, its version and who can reach it, because the record says the attacker needs a low privilege account and local or network access as listed.
What to do now
- Update to the fixed version listed in DSA-2026-385, following Dell's instructions for your edition.
- List every SCG instance, including test and lab copies, so none stays behind on the old version.
- Limit who can log in or reach the management interface to the staff who need it, and review the accounts that exist today.
- After the update, confirm the version number and check Dell's advisory for any follow-up configuration steps.
Why it matters
The record classes this as CWE-1188, an insecure default. A product ships with a setting that is weaker than it should be, and anyone who installs it and never changes it inherits the weakness. The fix is a safer default, plus a review of existing installs that may still carry the old value.
The record rates attack complexity high, and says the attacker needs a low privilege account. The listed outcome is: information disclosure. Check the settings your install actually has, since upgrading does not always change values that were already written to disk.
The SCG product is a gateway that connects Dell systems to support services, so it often sits close to infrastructure and credentials. Dell's advisory bundles several issues, and applying the update fixes them together, which is the main reason to treat this as one project and not several.
Quick check
Is there a workaround?
We could not read Dell's advisory, so check it. The record gives the fixed version as the remedy.
Is this exploited?
The record's KEV flag is false and we found no report of exploitation.
Sources
Last reviewed: 18 October 2026.
