CVE-2026-87425
An unauthenticated remote attacker can modify the TLS client trust store in Brocade ASCG versions before 3.5.0.
Published Oct 8, 2026 · updated Oct 14, 2026 · Brocade Brocade Active Support Connectivity Gateway
An unauthenticated remote attacker can modify the TLS client trust store in Brocade ASCG versions before 3.5.0. By supplying an unauthorized Certificate Authority (CA) certificate to an unauthenticated management interface, the attacker can cause the system to trust unauthorized certificates, potentially enabling Man-in-the-Middle (MITM) attacks against outbound communications with managed switches and peer nodes.
Timeline
Detection, updates, and resolution for this record.
Oct 8, 2026 · NIST NVD
Detected
An unauthenticated remote attacker can modify the TLS client trust store in Brocade ASCG versions before 3.5.0. By supplying an unauthorized Certificate Authority (CA) certificate to an unauthenticated management interface, the attacker can cause the system to trust unauthorized certificates, potentially enabling Man-in-the-Middle (MITM) attacks against outbound communications with managed switche
Oct 14, 2026 · NIST NVD
Updated
An unauthenticated remote attacker can modify the TLS client trust store in Brocade ASCG versions before 3.5.0. By supplying an unauthorized Certificate Authority (CA) certificate to an unauthenticated management interface, the attacker can cause the system to trust unauthorized certificates, potentially enabling Man-in-the-Middle (MITM) attacks against outbound communications with managed switche
Affected
- cpe broadcom/brocade active support connectivity gatewayversion unspecified
- vendor Brocade Brocade Active Support Connectivity Gatewayversion unspecified
Sources
- CIRCL Vulnerability LookupCVE-2026-87425
An unauthenticated remote attacker can modify the TLS client trust store in Brocade ASCG versions before 3.5.0. By supplying an unauthorized Certificate Authority (CA) certificate to an unauthenticated management interface, the attacker can cause the system to trust unauthorized
vulnerability.circl.lu - CVE.orgCVE-2026-87425
Official CVE identifier
cve.org - FIRST EPSSCVE-2026-87425
30-day exploitation probability 0.1%
first.org - NIST NVDCVE-2026-87425
An unauthenticated remote attacker can modify the TLS client trust store in Brocade ASCG versions before 3.5.0. By supplying an unauthorized Certificate Authority (CA) certificate to an unauthenticated management interface, the attacker can cause the system to trust unauthorized
nvd.nist.gov