CVE-2026-85417CWE-532

CVE-2026-85417

published September 25, 2026

CVSS
6.4
EPSS
0%
Percentile
8.3
In the wild
Unconfirmed
What it is

Incomplete property masking in the SANnav logging subsystem permits SNMP authentication and privacy passwords to be recorded in application logs under specific configuration conditions. Individuals with read access to system logs or support bundles can retrieve these credentials, leading to unauthorized read or management access to monitored switch environments

The record
Technical detail
CVSS
6.4 · NONE
CVSS v4.0
6.4 · CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H
EPSS
0.00191 · 8.3th percentile
Weakness
CWE-532 · Insertion of Sensitive Information into Log File
Published
2026-09-25T05:16Z
References (1)
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/39001 · [email protected]
EPSS history
Timeline
  • 26 SEP 03:27Z
    EPSS moved — → 0%
    epss
  • 25 SEP 00:03Z
    Incomplete property masking in the SANnav logging subsystem
    cvelistv5