Broadcom Brocade Active Support Connectivity Gateway vulnerabilities

18 CVEs affecting Broadcom Brocade Active Support Connectivity Gateway, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-87428, published 2026-10-08.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-0869, published 2026-03-03. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. Authentication bypass in Brocade ASCG 3.4.0 Could allow an unauthorized user to perform ASCG operations related to Brocade Support Link(BSL) and streaming configuration. and could even disable the…
CVE-2024-1509, published 2025-02-28. Critical severity, CVSS 9.1. EPSS: 0.4% chance of exploitation in the next 30 days. Brocade ASCG before 3.2.0 Web Interface is not enforcing HSTS, as defined by RFC 6797. HSTS is an optional response header that can be configured on the server to instruct the browser to only…
CVE-2026-85490, published 2026-10-08. High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days. When Brocade ASCG before 3.5.0 processes support bundle archives ingested from remote compromised endpoints, the application fails to sanitize path traversal sequences contained within archive…
CVE-2026-85486, published 2026-10-08. High severity, CVSS 8.0. EPSS: 0.3% chance of exploitation in the next 30 days. Brocade ASCG before 3.5.0 improperly processes user input by evaluating form data prior to validation. When an authenticated user submits a configuration form, the submitted text could immediately be…
CVE-2025-6391, published 2025-07-17. Critical severity, CVSS 9.1. EPSS: 0.2% chance of exploitation in the next 30 days. Brocade ASCG before 3.3.0 logs JSON Web Tokens (JWT) in log files. An attacker with access to the log files can withdraw the unencrypted tokens with security implications, such as unauthorized…
CVE-2026-85487, published 2026-10-08. High severity, CVSS 8.8. EPSS: 0.2% chance of exploitation in the next 30 days. A path traversal vulnerability exists in the HTTP service component of Brocade ASCG versions before 3.5.0. An unauthenticated attacker on the local network could send a manipulated API request to the…
CVE-2026-85423, published 2026-10-08. High severity, CVSS 8.8. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability has been identified in the data collection service of Brocade ASCG versions before 3.5.0. An API endpoint within the data collector service fails to perform authentication or…
CVE-2026-85421, published 2026-10-08. High severity, CVSS 8.8. EPSS: 0.2% chance of exploitation in the next 30 days. A critical security vulnerability has been identified in Brocade ASCG versions before 3.5.0. The HTTPS service fails to properly enforce authentication or access control checks on incoming requests.…
CVE-2026-85489, published 2026-10-08. High severity, CVSS 8.8. EPSS: 0.2% chance of exploitation in the next 30 days. An authentication flaw exists in the Brocade ASCG administrative management service component. An unauthenticated network user can issue direct API requests to perform privileged actions, including…
CVE-2026-87424, published 2026-10-08. High severity, CVSS 8.8. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability in the SupportLink API authentication component of Brocade ASCG versions prior to 3.5.0 allows an attacker to bypass authentication across deployments due to the use of a hard coded…

Latest

CVE-2026-87428, published 2026-10-08. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. In Brocade ASCG before 3.5.0, a local unauthorized user on the ASCG VM who can issue a request to the SANnav host network namespace can extract stored management credentials for onboarded SANnav…
CVE-2026-87426, published 2026-10-08. Medium severity, CVSS 4.3. EPSS: 0.1% chance of exploitation in the next 30 days. An unauthenticated network-based attacker can query specific internal management endpoints on Brocade ASCG versions before 3.5.0 to enumerate the configuration details and state of managed Brocade…
CVE-2026-87425, published 2026-10-08. Medium severity, CVSS 6.8. EPSS: 0.1% chance of exploitation in the next 30 days. An unauthenticated remote attacker can modify the TLS client trust store in Brocade ASCG versions before 3.5.0. By supplying an unauthorized Certificate Authority (CA) certificate to an…
CVE-2026-85488, published 2026-10-08. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Brocade ASCG before 3.5.0 has a well-known Brocade default password embedded in a script distributed to every customer. Any local authenticated user with read access to the installation path can…