Brocade ASCG: Missing authentication in HTTPS service
Summary
Brocade Active Support Connectivity Gateway (ASCG) versions before 3.5.0 have an HTTPS service that does not properly enforce authentication or access control on incoming requests. An unauthenticated attacker with network access can issue control commands, change cluster states and modify system configurations, which can lead to full compromise of the streaming service control plane. The product is a support and management appliance, so the main risk is an attacker reaching it from an internal network or through a misconfigured firewall rule.
Affected
- Brocade ASCG, all versions before 3.5.0
Fixed in
- Brocade ASCG 3.5.0 (security update)
Workaround
- No vendor workaround found in the sources reviewed. Status: unknown.
- Interim measure (not from a vendor source): restrict access to the ASCG HTTPS interface to a management VLAN or admin workstations and do not expose it to the internet.
Exploitation
- No evidence of exploitation in the wild found. No CISA KEV listing found in the sources reviewed (unverified).
- No public proof of concept found.
- CISA SSVC: exploitation none, not automatable, total technical impact.
- EPSS 0.00222 (low).
Our recommendation
- Patch Brocade ASCG to version 3.5.0 wherever it is deployed, after checking the Broadcom advisory for exact remediation details.
- Patching to 3.5.0 also covers related ASCG CVEs published the same day.
- Check whether the HTTPS interface is reachable from the internet or untrusted networks and restrict it to a management network.
- Monitor logs of the ASCG appliance for unexpected control commands or configuration changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Broadcom Security Advisory support.broadcom.com
- VulDB CVE-2026-85421 vuldb.com
- Rapid7 via Vulners CVE-2026-85421 vulners.com
- ACN (Italian CSIRT) Brocade alert www.acn.gov.it
- OffSeq Radar CVE-2026-85421 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 05:21.
Original description (NVD)
A critical security vulnerability has been identified in Brocade ASCG versions before 3.5.0. The HTTPS service fails to properly enforce authentication or access control checks on incoming requests. An unauthenticated attacker with network access can issue control commands, alter cluster states, and modify system configurations, leading to a complete compromise of the streaming service control plane.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.