CVE-2026-85489

Broadcom Brocade Active Support Connectivity Gateway: missing authentication

Risk score: 55/100
CVSS: 8.8 v3.1
Exploit chance (30 days): 0.2%
Published: 8 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: An authentication flaw exists in the Brocade ASCG administrative management service component. An unauthenticated network user can issue direct API requests to perform privileged actions, including accessing sensitive system configuration mapping data, modifying managed device inventories, and altering operational set…
Affected: Broadcom Brocade Active Support Connectivity Gateway before 3.5.0
Fix: Upgrade Broadcom Brocade Active Support Connectivity Gateway to 3.5.0 or later.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Broadcom Brocade Active Support Connectivity Gateway: Yellow, plan it in. When Brocade ASCG before 3.5.0 processes support bundle archives ingested from remote compromised endpoints, the application fails to sanitize path traversal sequences contained within archive entries prior to extraction. An unauthenticated remote attacker capable of sending or intercepting ingested archive files can …

The flaws

CVE-2026-85489: Missing authentication (CVSS 8.8 · EPSS 0%)
CVE-2026-85490: Path traversal can lead to remote code execution (CVSS 8.8 · EPSS 0%)
CVE-2026-85487: Path traversal (CVSS 8.8 · EPSS 0%)
CVE-2026-85423: Missing authentication (CVSS 8.8 · EPSS 0%)

The fix

Upgrade Broadcom Brocade Active Support Connectivity Gateway: 3.5.0 or later on your release line

Who is exposed: Broadcom Brocade Active Support Connectivity Gateway before 3.5.0

Where it stands

No known exploitation

Connects to

Same weakness: Missing authentication (CWE-306). 283 other warnings in 30 days
Same product: Earlier Broadcom Brocade Active Support Connectivity Gateway warnings. 10 in the last 90 days

Why it is Yellow

CVSS 8.8 high

References

https://support.broadcom.com/external/content/SecurityAdvisories/0/38388

Original description

An authentication flaw exists in the Brocade ASCG administrative management service component. An unauthenticated network user can issue direct API requests to perform privileged actions, including accessing sensitive system configuration mapping data, modifying managed device inventories, and altering operational settings. This vulnerability affects all versions of Brocade ASCG before 3.5.0.

Last activity 8 Oct 2026. Patch Forecast updates every hour.