CVE-2026-85486
Brocade ASCG before 3.5.0 improperly processes user input by evaluating form data prior to validation. When an authenticated user submits a configuration form, the submitted text could immediately be processed. A malicious actor with basic access can supply crafted input to execute arbitrary code on the server and take control of the application.
- Score
- CVSS 4.0 8.6 High
- Status
- Analyzed - sirt@brocade.com
- Published
- 2026-10-08
- Last modified
- 2026-10-14
- Weaknesses
- CWE-95
Affected products
- Brocade Active Support Connectivity Gateway (Broadcom)
- Brocade Active Support Connectivity Gateway (Brocade)
References
- https://support.broadcom.com/external/content/SecurityAdvisories/0/38381
