CVE-2026-85488: High severity Brocade ASCG vulnerability
Brocade ASCG before 3.5.0 has a well-known Brocade default password embedded in a script distributed to every customer. Any local authenticated user with read access to the installation path can discover this credential and perform privilege escalation on affected Open Virtual Appliance (OVA) deployments, where default configuration settings remain in place.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Brocade ASCGto a version that resolves this vulnerability.Fixed in 3.5.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Affected Open Virtual Appliance deployments of Brocade ASCG before 3.5.0 are exposed when default configuration settings remain in place. Exploitation also requires a local authenticated user with read access to the installation path.
What does an attacker need to exploit it?
An attacker needs local authenticated access and permission to read the ASCG installation path. They can then discover the embedded well-known default Brocade credential from a distributed script and use it for privilege escalation.
What should be prioritized if patching is not immediately possible?
Restrict local access and read permissions to the ASCG installation path, particularly for untrusted authenticated users. Review whether default configuration settings remain in place on OVA deployments and address them where possible.