Brocade ASCG: Code injection via pre-validation evaluation of form data
Summary
Brocade Active Support Connectivity Gateway (ASCG) before version 3.5.0 evaluates submitted form data before it is validated. An authenticated user with basic access who submits crafted input in a configuration form can execute arbitrary code on the server and take control of the application. The attack is rated as adjacent network access with low privileges required.
Affected
- Brocade ASCG versions before 3.5.0
Fixed in
- Brocade ASCG 3.5.0 (per the CVE record; confirm in the Broadcom advisory)
Workaround
Unknown.
Exploitation
- No public proof-of-concept exploit known at the time of research.
- Not listed in CISA KEV.
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Upgrade Brocade ASCG to version 3.5.0 or later.
- Restrict access to the ASCG configuration interface to administrators on a management network.
- Remove unneeded accounts and enforce strong, unique passwords.
- Review which users can submit configuration forms.
- Check the other ASCG CVEs published on 8 October 2026 (including CVE-2026-85489, CVE-2026-85423 and CVE-2026-85421); patching to 3.5.0 addresses the appliance as a whole.
- Read the Broadcom advisory 38381 to confirm the fixed version.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Broadcom Security Advisory 38381 support.broadcom.com
- VulDB: CVE-2026-85486 vuldb.com
- Vulners: CVE-2026-85486 record summary vulners.com
- PSIRT: CVE-2026-85486 psirt.com
- CVE threat intelligence mirror: CVE-2026-85486 cve.threatint.com
- Strix: CVE-2026-85423 www.strix.ai
- VulDB: CVE-2026-85489 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 09:08.
Original description (NVD)
Brocade ASCG before 3.5.0 improperly processes user input by evaluating form data prior to validation. When an authenticated user submits a configuration form, the submitted text could immediately be processed. A malicious actor with basic access can supply crafted input to execute arbitrary code on the server and take control of the application.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.