{"id":"CVE-2026-85489","state":"PUBLISHED","title":"An authentication flaw exists in the Brocade ASCG administrative management service component. An unauthenticated network user can issue direct API requests to perform privileged a","description":"An authentication flaw exists in the Brocade ASCG administrative management service component. An unauthenticated network user can issue direct API requests to perform privileged actions, including accessing sensitive system configuration mapping data, modifying managed device inventories, and altering operational settings. This vulnerability affects all versions of Brocade ASCG before 3.5.0.","publishedAt":"2026-10-08T06:39:59.090Z","updatedAt":"2026-10-08T17:45:58.708Z","severity":{"score":8.7,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","source":"brocade"},"assigner":"brocade","products":["Brocade Brocade Active Support Connectivity Gateway"],"affected":[{"vendor":"Brocade","product":"Brocade Active Support Connectivity Gateway","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"3.5.0","versionType":"Brocade ASC-G"}]}],"references":["https://support.broadcom.com/external/content/SecurityAdvisories/0/38388"],"weaknesses":["CWE-306"],"ingestedAt":"2026-10-29T20:13:15.269Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/85xxx/CVE-2026-85489.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-85489","state":"PUBLISHED","datePublished":"2026-10-08T06:39:59.090Z","dateUpdated":"2026-10-08T17:45:58.708Z","assignerShortName":"brocade","assignerOrgId":"87b297d7-335e-4844-9551-11b97995a791","dateReserved":"2026-09-03T21:31:03.838Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"An authentication flaw exists in the Brocade ASCG administrative management service component. An unauthenticated network user can issue direct API requests to perform privileged actions, including accessing sensitive system configuration mapping data, modifying managed device inventories, and altering operational settings. This vulnerability affects all versions of Brocade ASCG before 3.5.0."}],"affected":[{"vendor":"Brocade","product":"Brocade Active Support Connectivity Gateway","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"3.5.0","versionType":"Brocade ASC-G"}]}],"references":[{"url":"https://support.broadcom.com/external/content/SecurityAdvisories/0/38388"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"HIGH","baseScore":8.7,"vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-306","lang":"en","description":"CWE-306: Missing Authentication for Critical Function","type":"CWE"}]}],"providerMetadata":{"shortName":"brocade","orgId":"87b297d7-335e-4844-9551-11b97995a791","dateUpdated":"2026-10-08T06:39:59.090Z"},"impacts":[{"capecId":"CAPEC-309","descriptions":[{"lang":"en","value":"CAPEC-309 Network Topology Mapping"}]}],"solutions":[{"lang":"en","value":"Security update provided in Brocade ASCG 3.5.0","supportingMedia":[{"type":"text/html","base64":false,"value":"<div>Security update provided in Brocade ASCG 3.5.0</div>"}]}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.5"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-10-08T17:45:14.936091Z","id":"CVE-2026-85489","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-08T17:45:58.708Z"}}]}}}