CVE-2026-85423CWE-306
CVE-2026-85423
High · published October 8, 2026
What it is
A vulnerability has been identified in the data collection service of Brocade ASCG versions before 3.5.0. An API endpoint within the data collector service fails to perform authentication or authorization checks on incoming requests. An attacker with network access to the service can instruct the application to establish SSH connections to arbitrary hosts and execute arbitrary system commands, effectively turning the appliance into an unauthenticated proxy or execution vector.
The record
Technical detail
- CVSS v3.1
- 8.8 · HIGH
- Vector
- CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v4.0
- 8.6 · CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
- EPSS
- 0.00235 · 13.7th percentile
- Weakness
- CWE-306 · Missing Authentication for Critical Function
- Published
- 2026-10-08T11:16Z
Affected products (1)
| Product | Versions | Fixed in |
|---|
| broadcom/brocade_active_support_connectivity_gateway | < 3.5.0 | 3.5.0 |
References (1)
EPSS history
Timeline
09 OCT 03:32Z
EPSS moved — → 0%
epss
08 OCT 06:25Z
A vulnerability has been identified in the data collection service of Brocade ASCG versions before 3.5.0
cvelistv5
08 OCT 06:25Z
A vulnerability has been identified in the data collection service of Brocade ASCG versions before 3.5.0
cvelistv5