Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-87425

An unauthenticated remote attacker can modify the TLS client trust store in Brocade ASCG versions…

Risk score
41/100
CVSS
6.8 v3.1
Exploit chance (30 days)
0.1%
Published
8 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
An unauthenticated remote attacker can modify the TLS client trust store in Brocade ASCG versions before 3.5.0. By supplying an unauthorized Certificate Authority (CA) certificate to an unauthenticated management interface, the attacker can cause the system to trust unauthorized certificates, potentially enabling Man-…
Affected
Broadcom Brocade Active Support Connectivity Gateway before 3.5.0
Fix
Upgrade Broadcom Brocade Active Support Connectivity Gateway to 3.5.0 or later.
Exploitation
No known exploitation

Story map

Story map: Broadcom Brocade Active Support Connectivity GatewayTHE FLAWSTHE FIXCVE-2026-87425An unauthenticated remoteattacker can modify the TLSclient trust store in Brocade…CVSS 6.8 · EPSS 0%CVE-2026-85490Path traversal can lead toremote code executionCVSS 8.8 · EPSS 0%CVE-2026-85487Path traversalCVSS 8.8 · EPSS 0%CVE-2026-85423Missing authenticationCVSS 8.8 · EPSS 0%Upgrade Broadcom Brocade…3.5.0or later on your release lineWho is exposedBroadcom Brocade ActiveSupport Connectivity Gatewaybefore 3.5.0YELLOW · PLAN IT INBroadcomBrocade Active…When Brocade ASCG before 3.5.0processes support bundlearchives ingested from remotecompromised endpoints, theapplication fails to sanitize pathtraversal sequences containedwithin archive entries prior to…Where it standsNo known exploitationCONNECTS TOSame weaknessCWE-295 (CWE-295)82 other warnings in 30 days →Same productEarlier Broadcom Brocade Active SupportConnectivity Gateway warnings10 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Broadcom Brocade Active Support Connectivity Gateway: Yellow, plan it in. When Brocade ASCG before 3.5.0 processes support bundle archives ingested from remote compromised endpoints, the application fails to sanitize path traversal sequences contained within archive entries prior to extraction. An unauthenticated remote attacker capable of sending or intercepting ingested archive files can …

The flaws

  • CVE-2026-87425: An unauthenticated remote attacker can modify the TLS client trust store in Brocade ASCG versions… (CVSS 6.8 · EPSS 0%)
  • CVE-2026-85490: Path traversal can lead to remote code execution (CVSS 8.8 · EPSS 0%)
  • CVE-2026-85487: Path traversal (CVSS 8.8 · EPSS 0%)
  • CVE-2026-85423: Missing authentication (CVSS 8.8 · EPSS 0%)

The fix

Upgrade Broadcom Brocade Active Support Connectivity Gateway: 3.5.0 or later on your release line

Who is exposed: Broadcom Brocade Active Support Connectivity Gateway before 3.5.0

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 6.8 medium

References

Original description

An unauthenticated remote attacker can modify the TLS client trust store in Brocade ASCG versions before 3.5.0. By supplying an unauthorized Certificate Authority (CA) certificate to an unauthenticated management interface, the attacker can cause the system to trust unauthorized certificates, potentially enabling Man-in-the-Middle (MITM) attacks against outbound communications with managed switches and peer nodes.

Last activity 8 Oct 2026. Patch Forecast updates every hour.