CVE-2026-87428CWE-522

CVE-2026-87428

High · published October 8, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
0.7
In the wild
Unconfirmed
What it is

In Brocade ASCG before 3.5.0, a  local unauthorized user on the ASCG VM who can issue a request to the SANnav host network namespace can extract stored management credentials for onboarded SANnav instances and compromise connected Brocade SANnav servers or managed Brocade Fibre Channel switches.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
8.4 · CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00098 · 0.7th percentile
Weakness
CWE-522 · Insufficiently Protected Credentials
Published
2026-10-08T11:16Z
Affected products (1)
ProductVersionsFixed in
broadcom/brocade_active_support_connectivity_gateway< 3.5.03.5.0
References (1)
https://support.broadcom.com/external/content/SecurityAdvisories/0/38390 · [email protected]
EPSS history
Timeline
  • 09 OCT 03:32Z
    EPSS moved — → 0%
    epss
  • 08 OCT 07:00Z
    In Brocade ASCG before 3.5.0, a  local unauthorized user on the ASCG VM who can issue a request to the SANnav host network namespace can extract stored…
    cvelistv5
  • 08 OCT 07:00Z
    In Brocade ASCG before 3.5.0, a  local unauthorized user on the ASCG VM who can issue a request to the SANnav host network namespace can extract stored…
    cvelistv5