CVE-2026-85422: High severity Brocade ASCG vulnerability
A vulnerability in Brocade ASCG version before 3.5.0 could allow an attacker to obtain a static cryptographic key hardcoded into the software binaries to secure sensitive data at rest and to protect inter-node communication protocols. An attacker who extracts this key can decrypt stored management credentials or craft forged administrative synchronization messages.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Brocade ASCGto a version that resolves this vulnerability.Fixed in 3.5.0
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Deployments of Brocade ASCG before version 3.5.0 are affected. Exploitation requires an attacker to obtain and extract the hardcoded key from the software binaries, so exposure is greatest where a high-privileged local attacker can access those binaries.
What could an attacker do after extracting the key?
The key could be used to decrypt stored management credentials protected at rest. It could also allow forged administrative synchronization messages to be crafted for inter-node communication.
Does exploitation require prior privileges or user interaction?
The CVSS vector indicates high privileges are required and no user interaction is required. The attack vector is local, rather than network-based.
What is the available remediation?
Upgrade Brocade ASCG to version 3.5.0 or later. The affected range is versions before 3.5.0.