CVE-2026-73595 Code injection in Secure Connect Gateway (SCG) Policy Manager

Medium 4.7 Published 29 Sep 2026 Updated 30 Sep 2026

Unauthenticated remote attackers can execute code, read or modify data, and bypass protections in Dell Secure Connect Gateway Policy Manager.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2026-73595?

CVE-2026-73595 is a medium-severity code injection vulnerability in Dell Secure Connect Gateway (SCG) Policy Manager, published on 29 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, Versions prior to 5.36, contains a Download of Code Without Integrity Check vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Code execution, Information disclosure, Information tampering, and Protection mechanism bypass.

Weakness: CWE-494

Which versions are affected by CVE-2026-73595?

It affects 1 product.

Products include Dell Policy Manager for Secure Connect Gateway.

How do I fix CVE-2026-73595?

No fix has been published for CVE-2026-73595 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2026-73595 being exploited?

There is no known exploitation of CVE-2026-73595 in the wild and no public exploit code.

Sources

Also known as GHSA-q95v-h5rw-jhg8.