CVE-2026-78020 is a high severity (CVSS 7.5) flaw in Dell SCG Policy Manager before 5.34.00.16. According to the record, exploitation is network and needs no login. Dell fixed it in 5.34.00.16, so check your version and update. Details are in Dell's advisory.
What's affected
Dell Secure Connect Gateway (SCG) Policy Manager, all versions before 5.34.00.16. The fix is version 5.34.00.16 or later. The record names this product and lists the fix version; Dell's advisory is DSA-2026-385, titled as a security update for Policy Manager with multiple vulnerabilities.
We could not retrieve Dell's advisory (the site returned an access denied response to our request), so the versions here come from the NVD record only. Read the advisory itself to confirm affected editions and any extra steps before you plan the change. The record does not mark the issue as exploited, and the KEV flag is false.
How to check if you're exposed
Find the version of each SCG deployment and compare it with the fixed version.
In the Policy Manager web interface, look for the version in the About or system information view. If the product runs on a server you manage, also check the installed package or application list.
Dell shows these fields in different places by release, so use the product's own documentation if the labels differ. Record each instance, its version and who can reach it, because the record says the attacker needs no login and network or network access as listed.
What to do now
- Update to the fixed version listed in DSA-2026-385, following Dell's instructions for your edition.
- List every SCG instance, including test and lab copies, so none stays behind on the old version.
- Limit who can log in or reach the management interface to the staff who need it, and review the accounts that exist today.
- After the update, confirm the version number and check Dell's advisory for any follow-up configuration steps.
Why it matters
The record classes this as CWE-295, improper certificate validation. A client that does not check a server's certificate properly cannot tell the real server from an impostor. An attacker positioned on the network path can then present a false identity and read or alter traffic.
The record rates attack complexity high, and says the attacker needs no login. The listed outcome is: denial of service, information disclosure, and remote execution. Look at the connections the product makes to other services and make sure they go over verified TLS.
The SCG product is a gateway that connects Dell systems to support services, so it often sits close to infrastructure and credentials. Dell's advisory bundles several issues, and applying the update fixes them together, which is the main reason to treat this as one project and not several.
Quick check
Is there a workaround?
We could not read Dell's advisory, so check it. The record gives the fixed version as the remedy.
Is this exploited?
The record's KEV flag is false and we found no report of exploitation.
Sources
Last reviewed: 18 October 2026.
