CVE-2026-85489CWE-306

CVE-2026-85489

High · published October 8, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
11.3
In the wild
Unconfirmed
What it is

An authentication flaw exists in the Brocade ASCG administrative management service component. An unauthenticated network user can issue direct API requests to perform privileged actions, including accessing sensitive system configuration mapping data, modifying managed device inventories, and altering operational settings. This vulnerability affects all versions of Brocade ASCG before 3.5.0.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
EPSS
0.00215 · 11.3th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-10-08T11:16Z
Affected products (1)
ProductVersionsFixed in
broadcom/brocade_active_support_connectivity_gateway< 3.5.03.5.0
References (1)
https://support.broadcom.com/external/content/SecurityAdvisories/0/38388 · [email protected]
EPSS history
Timeline
  • 09 OCT 03:32Z
    EPSS moved — → 0%
    epss
  • 08 OCT 06:39Z
    An authentication flaw exists in the Brocade ASCG administrative management service component
    cvelistv5
  • 08 OCT 06:39Z
    An authentication flaw exists in the Brocade ASCG administrative management service component
    cvelistv5