Brocade vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-87428 In Brocade ASCG before 3.5.0, a  local unauthorized user on the ASCG VM who can issue a request to the SANnav host network namespace can extract stored managemeHigh 8.4 · Oct 8, 2026
• CVE-2026-87425 An unauthenticated remote attacker can modify the TLS client trust store in Brocade ASCG versions before 3.5.0.High 7.6 · Oct 8, 2026
• CVE-2026-87424 A vulnerability in the SupportLink API authentication component of Brocade ASCG versions prior to 3.5.0 allows an attacker to bypass authentication across deploHigh 8.6 · Oct 8, 2026
• CVE-2026-85490 When Brocade ASCG before 3.5.0 processes support bundle archives ingested from remote compromised endpoints, the application fails to sanitize path traversal seHigh 7.7 · Oct 8, 2026
• CVE-2026-85489 An authentication flaw exists in the Brocade ASCG administrative management service component.High 8.7 · Oct 8, 2026
• CVE-2026-85488 Brocade ASCG before 3.5.0 has a well-known Brocade default password embedded in a script distributed to every customer.High 7 · Oct 8, 2026
• CVE-2026-85487 A path traversal vulnerability exists in the HTTP service component of Brocade ASCG versions before 3.5.0.High 8.6 · Oct 8, 2026
• CVE-2026-85486 Brocade ASCG before 3.5.0 improperly processes user input by evaluating form data prior to validation.High 8.6 · Oct 8, 2026
• CVE-2026-85423 A vulnerability has been identified in the data collection service of Brocade ASCG versions before 3.5.0.High 8.6 · Oct 8, 2026
• CVE-2026-85422 A vulnerability in Brocade ASCG version before 3.5.0 could allow an attacker to obtain a static cryptographic key hardcoded into the software binaries to secureHigh 8.4 · Oct 8, 2026
• CVE-2026-85421 A critical security vulnerability has been identified in Brocade ASCG versions before 3.5.0.High 8.7 · Oct 8, 2026
• CVE-2026-5047 A vulnerability in Brocade SANnav before 2.4.0b and 3.0.0 prints encoded passwords and  authentication tokens in log files.High 8.2 · Oct 8, 2026
• CVE-2026-94586 A command injection vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operations of Brocade Fabric High 8.5 · Oct 8, 2026
• CVE-2026-94585 An authentication bypass vulnerability exists in the web management interface of Brocade Fabric OS versions before 9.2.2d running on the MXG610 platform.High 7.7 · Oct 8, 2026
• CVE-2026-94581 An OS command injection vulnerability exists in the REST API management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 allowsHigh 8.5 · Oct 8, 2026
• CVE-2026-94577 A privilege escalation vulnerability exists in the internal Command-Line Interface (CLI) authorization handling mechanism of Brocade Fabric OS versions before 9High 7.3 · Oct 8, 2026
• CVE-2026-87664 A session context forgery vulnerability exists in the web management daemon of Brocade Fabric OS versions 9.2.2d and 10.0.0 through 10.0.0a1.High 8.5 · Oct 8, 2026
• CVE-2026-87663 An authentication bypass and command injection vulnerability exists in the inter-switch remote execution service of Brocade Fabric OS versions before 9.2.2d andHigh 7.1 · Oct 8, 2026
• CVE-2026-87662 Brocade Fabric versions before 9.2.2d and 10.0.0 through 10.0.0a1 handling of specific download protocols utilizes unsanitized parameter strings.High 7 · Oct 8, 2026
• CVE-2026-87688 An input validation vulnerability exists in the security certificate management component of the Brocade Fabric OS administrative management API.High 8.5 · Oct 8, 2026
• CVE-2026-87687 An authorization and input validation vulnerability exists in Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1.High 8.5 · Oct 8, 2026
• CVE-2026-87685 An arbitrary file manipulation vulnerability exists in the WebTools management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1High 8.4 · Oct 8, 2026
• CVE-2026-87675 An OS command injection vulnerability exists in the configuration management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1.High 7.3 · Oct 8, 2026
• CVE-2026-87674 A local privilege escalation vulnerability exists in the system logging daemon of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1.High 8.5 · Oct 8, 2026
• CVE-2026-87673 An OS command injection vulnerability exists in maintenance command-line diagnostic utilities on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.High 7 · Oct 8, 2026