Brocade ASCG: Authentication bypass via hard-coded cryptographic key
Summary
Brocade Active Support Connectivity Gateway (ASCG) versions before 3.5.0 use a hard-coded cryptographic key in the SupportLink API authentication component. An attacker with adjacent network access and low privileges could bypass authentication and potentially gain full control over the management plane. The CVE record rates the attack vector as adjacent, and the research notes disagree with it on whether the flaw is remotely reachable, so exposure should be checked directly.
Affected
- Brocade Active Support Connectivity Gateway (ASCG) versions prior to 3.5.0
- Exact lower bound of the affected range: Unknown.
Fixed in
- Upgrade to Active Support Connectivity Gateway 3.5.0.
Workaround
- Unknown. No vendor-confirmed workaround found.
- Third-party guidance (VulDB): restrict access to the SupportLink API interface to trusted management stations and keep it away from untrusted networks.
Exploitation
- No public proof-of-concept found.
- No evidence of exploitation in the wild found. CISA KEV status: Unknown.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- EPSS: 0.0019 (as of its listing date).
Our recommendation
- Check whether Brocade ASCG is installed and identify all instances, including older versions below 3.5.0.
- Upgrade all ASCG instances to 3.5.0. Patch the sibling advisories published the same day together with this one.
- Restrict network access to the SupportLink API to trusted management hosts and segment it from user networks.
- Verify the scoring and affected range in the Broadcom advisory before finalizing the risk assessment.
- Monitor logs for unexpected API authentication activity.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Broadcom Security Advisory support.broadcom.com
- CVE record mirror (threatint) cve.threatint.com
- VulDB CVE-2026-87424 vuldb.com
- VulDB vulnerability 415302 vuldb.com
- Vulners RAPID7:CVE-2026-87424 vulners.com
- OffSeq Radar CVE-2026-87424 radar.offseq.com
- Sibling advisory CVE-2026-85488 (Strix) www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 09:07.
Original description (NVD)
A vulnerability in the SupportLink API authentication component of Brocade ASCG versions prior to 3.5.0 allows an attacker to bypass authentication across deployments due to the use of a hard coded cryptographic key.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.