Dell: Twelve Vulnerabilities Across SCG, BOSS, and Live Optics Disclosed Together
Dell disclosed twelve vulnerabilities in its Secure Connect Gateway, BOSS, and Live Optics Collector products, ranging from Medium to High severity, patched in updates released September 28-29, 2026.
Key findings
- Dell disclosed twelve vulnerabilities across SCG Policy Manager, BOSS, and Live Optics Collector between September 28-29, 2026.
- Seven vulnerabilities affect SCG Policy Manager (versions prior to 5.34.00.16), including a High-severity privilege escalation flaw.
- Three BOSS 17G controllers (versions prior to 2.2.13.2038) have High and Medium severity flaws related to improper access control.
- Live Optics Collector (versions prior to 27.2.13.310) has a Medium-severity hard-coded password vulnerability.
- Patches are available for all affected products, with users urged to update to specific fixed versions.
On September 28-29, 2026, Dell disclosed a batch of twelve vulnerabilities affecting its Secure Connect Gateway (SCG) Policy Manager, Boot Optimized Server Storage (BOSS), and Live Optics Collector products. The vulnerabilities, disclosed within a 22-hour window, range in severity from Low to High, with several allowing for privilege escalation and information disclosure. This coordinated disclosure event highlights potential risks for organizations utilizing these Dell products for network management and data collection.
The Dell Secure Connect Gateway (SCG) Policy Manager is impacted by seven vulnerabilities, all affecting versions prior to 5.34.00.16. These include a High-severity Incorrect Permission Assignment for Critical Resource vulnerability (CVE-2026-73598), which could allow a local attacker to elevate privileges. Other SCG vulnerabilities include Cleartext Transmission of Sensitive Information (CVE-2026-76114), an Open Redirect flaw leading to potential server-side request forgery (CVE-2026-73599), a Cross-Site Request Forgery (CSRF) vulnerability (CVE-2026-73597), an Initialization of a Resource with an Insecure Default (CVE-2026-73596), a Download of Code Without Integrity Check (CVE-2026-73595), and an Improper Certificate Validation vulnerability (CVE-2026-73594). Additionally, an Active Debug Code vulnerability (CVE-2026-73593) was noted.
The Dell Boot Optimized Server Storage (BOSS) product, specifically 17G BOSS-N1 controllers, is affected by three vulnerabilities (CVE-2026-80359, CVE-2026-80358, CVE-2026-80357), all related to improper access control in the SMCU's on-chip debug and test interface. These vulnerabilities affect versions prior to 2.2.13.2038. CVE-2026-80357 is rated High severity, while the other two are Medium. Exploitation could lead to unauthorized access and other security breaches. These three BOSS vulnerabilities, along with a vulnerability in the Live Optics Collector, were highlighted in a Vypr Intelligence report.
The Dell Live Optics Collector, versions prior to 27.2.13.310, contains a Use of Hard-coded Password vulnerability (CVE-2026-70413), rated Medium severity. This flaw could allow a low-privileged attacker with local access to expose information.
Dell has addressed these vulnerabilities through software updates. For SCG Policy Manager, version 5.34.00.16 is recommended. For BOSS, version 2.2.13.2038 is the patched release, and for Live Optics Collector, version 27.2.13.310 resolves the identified issues. Users of these Dell products are strongly advised to update to the latest versions to mitigate the risks associated with these disclosed vulnerabilities.
The coordinated disclosure of these twelve vulnerabilities across multiple Dell products underscores the importance of timely patching and security updates. Organizations relying on Dell's SCG, BOSS, and Live Optics solutions should prioritize applying the available patches to protect against potential exploitation, which could lead to unauthorized access, data breaches, and system compromise.
The batch includes:
- Seven vulnerabilities in Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16.
- Three vulnerabilities in Dell Boot Optimized Server Storage (BOSS) 17G BOSS-N1 controllers, versions prior to 2.2.13.2038.
- One vulnerability in Dell Live Optics Collector, versions prior to 27.2.13.310.
The vulnerabilities range from Low to High severity, with potential impacts including privilege escalation, information disclosure, and unauthorized access.
Dell has released patches for all affected products, with specific version numbers provided for remediation.
Users are urged to update their systems to the patched versions to secure their environments. CVE-2026-76114, CVE-2026-73599, CVE-2026-73598, CVE-2026-73597, CVE-2026-73596, CVE-2026-73595, CVE-2026-73594, CVE-2026-73593, CVE-2026-80359, CVE-2026-80358, CVE-2026-80357, CVE-2026-70413.