CVE-2026-85488

Analyzed Analyzed - Analysis Complete

BaseFortify

Publication date: 2026-10-08

Last updated on: 2026-10-14

Assigner: Brocade Communications Systems, LLC

Description

Brocade ASCG before 3.5.0 has a well-known Brocade default password embedded in a script distributed to every customer. Any local authenticated user with read access to the installation path can discover this credential and perform privilege escalation on affected Open Virtual Appliance (OVA) deployments, where default configuration settings remain in place.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-08

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-08

EPSS Evaluated

2026-10-18

NVD

CVE-2026-85488

EUVD

EUVD-2026-94791

Affected Vendors & Products

Vendor	Product	Version / Range
broadcom	brocade_active_support_connectivity_gateway	to 3.5.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-798	The product contains hard-coded credentials, such as a password or cryptographic key.

Attack-Flow Graph

Executive Summary

Brocade ASCG before version 3.5.0 contains a hardcoded default password in a script provided to customers. Local authenticated users with read access to the installation path can find this password and use it to escalate privileges. This affects Open Virtual Appliance deployments where default settings are unchanged.

Detection Guidance

Check for the presence of Brocade ASCG versions before 3.5.0 by inspecting installed scripts or configuration files in the default installation path. Look for embedded default credentials in readable files.

Impact Analysis

An attacker with local access could exploit this to gain elevated privileges on the system. This could allow unauthorized control over the Brocade ASCG, potentially leading to data breaches or further network compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Upgrade Brocade ASCG to version 3.5.0 or later to remove the default embedded password. Ensure default configuration settings are changed to prevent privilege escalation.

Hi! I’m here to help you understand CVE-2026-85488. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70