CVE-2026-85488

Broadcom Brocade Active Support Connectivity Gateway: hard-coded credentials can lead to privilege escalation

Risk score: 47/100
CVSS: 7.8 v3.1
Exploit chance (30 days): 0.1%
Published: 8 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: Brocade ASCG before 3.5.0 has a well-known Brocade default password embedded in a script distributed to every customer. Any local authenticated user with read access to the installation path can discover this credential and perform privilege escalation on affected Open Virtual Appliance (OVA) deployments, where defaul…
Affected: Broadcom Brocade Active Support Connectivity Gateway before 3.5.0
Fix: Upgrade Broadcom Brocade Active Support Connectivity Gateway to 3.5.0 or later.
Exploitation: No known exploitation

Why it is Yellow

CVSS 7.8 high

References

https://support.broadcom.com/external/content/SecurityAdvisories/0/38384

Original description

Brocade ASCG before 3.5.0 has a well-known Brocade default password embedded in a script distributed to every customer. Any local authenticated user with read access to the installation path can discover this credential and perform privilege escalation on affected Open Virtual Appliance (OVA) deployments, where default configuration settings remain in place.

Last activity 8 Oct 2026. Patch Forecast updates every hour.