CVE-2026-85423
A vulnerability has been identified in the data collection service of Brocade ASCG versions before 3.5.0.
Published Oct 8, 2026 · updated Oct 14, 2026 · Brocade Brocade Active Support Connectivity Gateway
A vulnerability has been identified in the data collection service of Brocade ASCG versions before 3.5.0. An API endpoint within the data collector service fails to perform authentication or authorization checks on incoming requests. An attacker with network access to the service can instruct the application to establish SSH connections to arbitrary hosts and execute arbitrary system commands, effectively turning the appliance into an unauthenticated proxy or execution vector.
Timeline
Detection, updates, and resolution for this record.
Oct 8, 2026 · NIST NVD
Detected
A vulnerability has been identified in the data collection service of Brocade ASCG versions before 3.5.0. An API endpoint within the data collector service fails to perform authentication or authorization checks on incoming requests. An attacker with network access to the service can instruct the application to establish SSH connections to arbitrary hosts and execute arbitrary system commands, eff
Oct 14, 2026 · NIST NVD
Updated
A vulnerability has been identified in the data collection service of Brocade ASCG versions before 3.5.0. An API endpoint within the data collector service fails to perform authentication or authorization checks on incoming requests. An attacker with network access to the service can instruct the application to establish SSH connections to arbitrary hosts and execute arbitrary system commands, eff
Affected
- cpe broadcom/brocade active support connectivity gatewayversion unspecified
- vendor Brocade Brocade Active Support Connectivity Gatewayversion unspecified
Sources
- CIRCL Vulnerability LookupCVE-2026-85423
A vulnerability has been identified in the data collection service of Brocade ASCG versions before 3.5.0. An API endpoint within the data collector service fails to perform authentication or authorization checks on incoming requests. An attacker with network access to the service
vulnerability.circl.lu - CVE.orgCVE-2026-85423
Official CVE identifier
cve.org - FIRST EPSSCVE-2026-85423
30-day exploitation probability 0.2%
first.org - NIST NVDCVE-2026-85423
A vulnerability has been identified in the data collection service of Brocade ASCG versions before 3.5.0. An API endpoint within the data collector service fails to perform authentication or authorization checks on incoming requests. An attacker with network access to the service
nvd.nist.gov