CVE-2026-85421
Received Received - Intake

Brocade ASCG Authentication Bypass in HTTPS Service

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: Brocade Communications Systems, LLC

Description
A critical security vulnerability has been identified in Brocade ASCG versions before 3.5.0. The HTTPS service fails to properly enforce authentication or access control checks on incoming requests. An unauthenticated attacker with network access can issue control commands, alter cluster states, and modify system configurations, leading to a complete compromise of the streaming service control plane.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-08
Last Modified
2026-10-08
Generated
2026-10-08
AI Q&A
2026-10-08
EPSS Evaluated
N/A
NVD
CVE-2026-85421
EUVD
EUVD-2026-94786

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Brocade Brocade Active Support Connectivity Gateway 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Brocade ASCG versions before 3.5.0. The HTTPS service does not enforce authentication or access control checks on incoming requests. An unauthenticated attacker with network access can send control commands, change cluster states, and modify system configurations, leading to full compromise of the streaming service control plane.

Detection Guidance

Check Brocade ASCG versions before 3.5.0 by running version check commands like 'show version' or 'system-info' on the device. Monitor network traffic for unauthorized HTTPS requests to ASCG ports (default 443). Inspect logs for failed authentication attempts or unexpected control commands.

Impact Analysis

An attacker could take over the streaming service control plane, disrupt services, steal data, or alter configurations without authorization. This could lead to service outages, data breaches, or unauthorized access to sensitive information.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's data protection requirements and HIPAA's security and privacy rules. Organizations using affected versions may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Upgrade Brocade ASCG to version 3.5.0 or later immediately. Disable unnecessary network access to ASCG ports. Implement strict firewall rules to restrict HTTPS traffic to trusted sources only. Review and audit all system configurations for unauthorized changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85421. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart