CVE-2026-85489: High severity Brocade ASCG vulnerability
An authentication flaw exists in the Brocade ASCG administrative management service component. An unauthenticated network user can issue direct API requests to perform privileged actions, including accessing sensitive system configuration mapping data, modifying managed device inventories, and altering operational settings. This vulnerability affects all versions of Brocade ASCG before 3.5.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Brocade ASCGto a version that resolves this vulnerability.Fixed in 3.5.0
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An unauthenticated network user can exploit it by sending direct API requests to the Brocade ASCG administrative management service. No credentials or user interaction are required.
Which deployments are affected?
All Brocade ASCG versions before 3.5.0 are affected. The provided information does not identify any configuration prerequisite or non-default setting required for exploitation.
What could an attacker do after exploiting it?
An attacker can perform privileged actions through the API, including accessing sensitive system configuration mapping data, modifying managed device inventories, and changing operational settings.
What version addresses the issue?
Brocade ASCG 3.5.0 is not listed as affected; versions before 3.5.0 are affected.