CVE-2026-85422

Broadcom Brocade Active Support Connectivity Gateway: hard-coded credentials

Risk score: 47/100
CVSS: 7.8 v3.1
Exploit chance (30 days): 0.1%
Published: 8 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: A vulnerability in Brocade ASCG version before 3.5.0 could allow an attacker to obtain a static cryptographic key hardcoded into the software binaries to secure sensitive data at rest and to protect inter-node communication protocols. An attacker who extracts this key can decrypt stored management credentials or craft…
Affected: Broadcom Brocade Active Support Connectivity Gateway before 3.5.0
Fix: Upgrade Broadcom Brocade Active Support Connectivity Gateway to 3.5.0 or later.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Broadcom Brocade Active Support Connectivity Gateway: Yellow, plan it in. When Brocade ASCG before 3.5.0 processes support bundle archives ingested from remote compromised endpoints, the application fails to sanitize path traversal sequences contained within archive entries prior to extraction. An unauthenticated remote attacker capable of sending or intercepting ingested archive files can …

The flaws

CVE-2026-85422: Hard-coded credentials (CVSS 7.8 · EPSS 0%)
CVE-2026-85490: Path traversal can lead to remote code execution (CVSS 8.8 · EPSS 0%)
CVE-2026-85487: Path traversal (CVSS 8.8 · EPSS 0%)
CVE-2026-85423: Missing authentication (CVSS 8.8 · EPSS 0%)

The fix

Upgrade Broadcom Brocade Active Support Connectivity Gateway: 3.5.0 or later on your release line

Who is exposed: Broadcom Brocade Active Support Connectivity Gateway before 3.5.0

Where it stands

No known exploitation

Connects to

Same weakness: Hard-coded credentials (CWE-798). 41 other warnings in 30 days
Same product: Earlier Broadcom Brocade Active Support Connectivity Gateway warnings. 10 in the last 90 days

Why it is Yellow

CVSS 7.8 high

References

https://support.broadcom.com/external/content/SecurityAdvisories/0/38379

Original description

A vulnerability in Brocade ASCG version before 3.5.0 could allow an attacker to obtain a static cryptographic key hardcoded into the software binaries to secure sensitive data at rest and to protect inter-node communication protocols. An attacker who extracts this key can decrypt stored management credentials or craft forged administrative synchronization messages.

Last activity 8 Oct 2026. Patch Forecast updates every hour.