{"id":"CVE-2026-82371","state":"PUBLISHED","title":"Plaintext exposure of sensitive authentication data in SANnav discovery service log files","description":"Plaintext exposure of sensitive authentication data in Brocade SANnav discovery service log files enables individuals with file read access to retrieve administrative switch credentials and active session tokens. An attacker with access to system logs or support bundles can leverage exposed authentication details to compromise managed network infrastructure and access active application sessions. This vulnerability affects Brocade SANnav versions before 3.0.1a.","publishedAt":"2026-09-24T18:20:10.791Z","updatedAt":"2026-10-01T20:18:18.322Z","severity":{"score":8.5,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"brocade"},"assigner":"brocade","products":["Brocade SANnav"],"affected":[{"vendor":"Brocade","product":"SANnav","defaultStatus":"unaffected","versions":[{"version":"before","status":"affected","lessThan":"3.0.1a","changes":[{"at":"3.0.1a","status":"unaffected"}],"versionType":"Brocade SANnav"}]}],"references":["https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38996"],"weaknesses":["CWE-532"],"ingestedAt":"2026-10-29T20:13:15.269Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/82xxx/CVE-2026-82371.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-82371","state":"PUBLISHED","datePublished":"2026-09-24T18:20:10.791Z","dateUpdated":"2026-10-01T20:18:18.322Z","assignerShortName":"brocade","assignerOrgId":"87b297d7-335e-4844-9551-11b97995a791","dateReserved":"2026-08-28T19:39:58.088Z"},"containers":{"cna":{"title":"Plaintext exposure of sensitive authentication data in SANnav discovery service log files","descriptions":[{"lang":"en","value":"Plaintext exposure of sensitive authentication data in Brocade SANnav discovery service log files enables individuals with file read access to retrieve administrative switch credentials and active session tokens. An attacker with access to system logs or support bundles can leverage exposed authentication details to compromise managed network infrastructure and access active application sessions. This vulnerability affects Brocade SANnav versions before 3.0.1a."}],"affected":[{"vendor":"Brocade","product":"SANnav","defaultStatus":"unaffected","versions":[{"version":"before","status":"affected","lessThan":"3.0.1a","changes":[{"at":"3.0.1a","status":"unaffected"}],"versionType":"Brocade SANnav"}]}],"references":[{"url":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38996"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"HIGH","baseScore":8.5,"vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-532","lang":"en","description":"CWE-532 Insertion of sensitive information into log file","type":"CWE"}]}],"providerMetadata":{"shortName":"brocade","orgId":"87b297d7-335e-4844-9551-11b97995a791","dateUpdated":"2026-10-01T20:18:18.322Z"},"impacts":[{"capecId":"CAPEC-37","descriptions":[{"lang":"en","value":"CAPEC-37 Retrieve Embedded Sensitive Data"}]}],"solutions":[{"lang":"en","value":"Security update provided in Brocade SANnav 3.0.1a","supportingMedia":[{"type":"text/html","base64":false,"value":"<span>Security update provided in Brocade SANnav 3.0.1a</span>"}]}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.5"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-09-24T18:37:39.127028Z","id":"CVE-2026-82371","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-24T18:37:45.076Z"}}]}}}