CVE-2026-85490

Broadcom Brocade Active Support Connectivity Gateway: path traversal can lead to remote code execution

Risk score: 57/100
CVSS: 8.8 v3.1
Exploit chance (30 days): 0.3%
Published: 8 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: When Brocade ASCG before 3.5.0 processes support bundle archives ingested from remote compromised endpoints, the application fails to sanitize path traversal sequences contained within archive entries prior to extraction. An unauthenticated remote attacker capable of sending or intercepting ingested archive files can …
Affected: Broadcom Brocade Active Support Connectivity Gateway before 3.5.0
Fix: Upgrade Broadcom Brocade Active Support Connectivity Gateway to 3.5.0 or later.
Exploitation: No known exploitation

Why it is Yellow

CVSS 8.8 high

References

https://support.broadcom.com/external/content/SecurityAdvisories/0/38389

Original description

When Brocade ASCG before 3.5.0 processes support bundle archives ingested from remote compromised endpoints, the application fails to sanitize path traversal sequences contained within archive entries prior to extraction. An unauthenticated remote attacker capable of sending or intercepting ingested archive files can leverage this flaw to write arbitrary files to restricted locations on the underlying host, potentially leading to remote code execution.

Last activity 8 Oct 2026. Patch Forecast updates every hour.