CVE-2026-14442

Received Received - Intake

Information Exposure in SANnav Job Scheduling Component

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: Brocade Communications Systems, LLC

Description

An information exposure vulnerability in the job scheduling component of SANnav allows sensitive credentials to be written to application logs in plain text. When scheduled support save jobs or related operational tasks are executed, sensitive parameters including external server passwords and archive protection keys are logged without proper masking. A local or authenticated user with access to application logs or support bundles can view these cleartext credentials, potentially leading to unauthorized access to remote backup targets or protected archives.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-09-24

Generated

2026-09-25

AI Q&A

2026-09-25

EPSS Evaluated

N/A

NVD

CVE-2026-14442

Affected Vendors & Products

Vendor	Product	Version / Range
brocade	sannav	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-532	The product writes sensitive information to a log file.

Attack-Flow Graph

Executive Summary

This vulnerability is an information exposure issue in SANnav's job scheduling component. Sensitive credentials like passwords and archive protection keys are written in plain text to application logs when scheduled support save jobs or operational tasks run. Local or authenticated users with log access can view these credentials, risking unauthorized access to remote backup targets or protected archives.

Detection Guidance

Check application logs for plaintext credentials in job scheduling components. Look for entries related to scheduled support save jobs or operational tasks that may contain sensitive parameters like external server passwords or archive protection keys.

Impact Analysis

If you use SANnav, attackers with log access could steal credentials and gain unauthorized access to your backup systems or encrypted archives. This may lead to data breaches, loss of sensitive information, or disruption of backup operations.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and privacy, such as GDPR and HIPAA, due to the exposure of sensitive credentials and potential unauthorized access to protected data. Organizations may face legal penalties and reputational damage.

Mitigation Strategies

Review and update logging configurations to mask sensitive credentials. Restrict access to application logs and support bundles to authorized personnel only. Consider disabling or modifying scheduled jobs that expose plaintext credentials until a patch is applied.

Hi! I’m here to help you understand CVE-2026-14442. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70