CVE-2026-85421

Broadcom Brocade Active Support Connectivity Gateway: missing authentication

Risk score: 55/100
CVSS: 8.8 v3.1
Exploit chance (30 days): 0.2%
Published: 8 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: A critical security vulnerability has been identified in Brocade ASCG versions before 3.5.0. The HTTPS service fails to properly enforce authentication or access control checks on incoming requests. An unauthenticated attacker with network access can issue control commands, alter cluster states, and modify system conf…
Affected: Broadcom Brocade Active Support Connectivity Gateway before 3.5.0
Fix: Upgrade Broadcom Brocade Active Support Connectivity Gateway to 3.5.0 or later.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Broadcom Brocade Active Support Connectivity Gateway: Yellow, plan it in. When Brocade ASCG before 3.5.0 processes support bundle archives ingested from remote compromised endpoints, the application fails to sanitize path traversal sequences contained within archive entries prior to extraction. An unauthenticated remote attacker capable of sending or intercepting ingested archive files can …

The flaws

CVE-2026-85421: Missing authentication (CVSS 8.8 · EPSS 0%)
CVE-2026-85490: Path traversal can lead to remote code execution (CVSS 8.8 · EPSS 0%)
CVE-2026-85487: Path traversal (CVSS 8.8 · EPSS 0%)
CVE-2026-85423: Missing authentication (CVSS 8.8 · EPSS 0%)

The fix

Upgrade Broadcom Brocade Active Support Connectivity Gateway: 3.5.0 or later on your release line

Who is exposed: Broadcom Brocade Active Support Connectivity Gateway before 3.5.0

Where it stands

No known exploitation

Connects to

Same weakness: Missing authentication (CWE-306). 282 other warnings in 30 days
Same product: Earlier Broadcom Brocade Active Support Connectivity Gateway warnings. 10 in the last 90 days

Why it is Yellow

CVSS 8.8 high

References

https://support.broadcom.com/external/content/SecurityAdvisories/0/38378

Original description

A critical security vulnerability has been identified in Brocade ASCG versions before 3.5.0. The HTTPS service fails to properly enforce authentication or access control checks on incoming requests. An unauthenticated attacker with network access can issue control commands, alter cluster states, and modify system configurations, leading to a complete compromise of the streaming service control plane.

Last activity 8 Oct 2026. Patch Forecast updates every hour.