CVE-2026-87426: Infoleak
An unauthenticated network-based attacker can query specific internal management endpoints on Brocade ASCG versions before 3.5.0 to enumerate the configuration details and state of managed Brocade Fabric OS (FOS) switches. This results in the unauthorized disclosure of the customer's SAN fabric management topology and switch connectivity attributes.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Brocade ASCGto a version that resolves this vulnerability.Fixed in 3.5.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Brocade ASCG versions before 3.5.0 are affected. Exposure requires that an attacker can reach the product's internal management endpoints over the network.
Does exploitation require credentials or user interaction?
No. The issue can be exploited by an unauthenticated network-based attacker, with no user interaction required.
What information can an attacker obtain?
An attacker can enumerate configuration details and state for managed Brocade Fabric OS switches, including SAN fabric management topology and switch connectivity attributes.
What is the available remediation?
Upgrade Brocade ASCG to version 3.5.0 or later. The provided information does not identify a workaround for systems that cannot yet be upgraded.