Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-87424

Broadcom Brocade Active Support Connectivity Gateway: authentication bypass

Risk score
54/100
CVSS
8.8 v3.1
Exploit chance (30 days)
0.2%
Published
8 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
A vulnerability in the SupportLink API authentication component of Brocade ASCG versions prior to 3.5.0 allows an attacker to bypass authentication across deployments due to the use of a hard coded cryptographic key.
Affected
Broadcom Brocade Active Support Connectivity Gateway before 3.5.0
Fix
Upgrade Broadcom Brocade Active Support Connectivity Gateway to 3.5.0 or later.
Exploitation
No known exploitation

Story map

Story map: Broadcom Brocade Active Support Connectivity GatewayTHE FLAWSTHE FIXCVE-2026-87424Authentication bypassCVSS 8.8 · EPSS 0%CVE-2026-85490Path traversal can lead toremote code executionCVSS 8.8 · EPSS 0%CVE-2026-85487Path traversalCVSS 8.8 · EPSS 0%CVE-2026-85423Missing authenticationCVSS 8.8 · EPSS 0%Upgrade Broadcom Brocade…3.5.0or later on your release lineWho is exposedBroadcom Brocade ActiveSupport Connectivity Gatewaybefore 3.5.0YELLOW · PLAN IT INBroadcomBrocade Active…When Brocade ASCG before 3.5.0processes support bundlearchives ingested from remotecompromised endpoints, theapplication fails to sanitize pathtraversal sequences containedwithin archive entries prior to…Where it standsNo known exploitationCONNECTS TOSame weaknessCWE-321 (CWE-321)32 other warnings in 30 days →Same productEarlier Broadcom Brocade Active SupportConnectivity Gateway warnings10 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Broadcom Brocade Active Support Connectivity Gateway: Yellow, plan it in. When Brocade ASCG before 3.5.0 processes support bundle archives ingested from remote compromised endpoints, the application fails to sanitize path traversal sequences contained within archive entries prior to extraction. An unauthenticated remote attacker capable of sending or intercepting ingested archive files can …

The flaws

The fix

Upgrade Broadcom Brocade Active Support Connectivity Gateway: 3.5.0 or later on your release line

Who is exposed: Broadcom Brocade Active Support Connectivity Gateway before 3.5.0

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 8.8 high

References

Original description

A vulnerability in the SupportLink API authentication component of Brocade ASCG versions prior to 3.5.0 allows an attacker to bypass authentication across deployments due to the use of a hard coded cryptographic key.

Last activity 8 Oct 2026. Patch Forecast updates every hour.