CVE-2026-85487: Path Traversal
A path traversal vulnerability exists in the HTTP service component of Brocade ASCG versions before 3.5.0. An unauthenticated attacker on the local network could send a manipulated API request to the service endpoint bypassing path restrictions to arbitrary file read, file write, or file deletion operations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Brocade ASCGto a version that resolves this vulnerability.Fixed in 3.5.0
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An unauthenticated attacker on the local network can exploit it. The attacker does not need prior access or user interaction, but must be able to reach the affected HTTP service endpoint.
Which versions are affected?
Brocade ASCG versions before 3.5.0 are affected. Version 3.5.0 is identified as the version boundary in the available information.
What could an attacker do after successful exploitation?
A manipulated API request can bypass path restrictions and enable arbitrary file read, file write, or file deletion operations.
What can be done if upgrading is not immediately possible?
The provided information does not specify a workaround. Restricting local-network access to the HTTP service endpoint can reduce exposure because exploitation requires network reachability to that endpoint.