Brocade Active Support Connectivity Gateway (Broadcom) - vulnerabilities (CVEs)
18 CVEs, 14 in the last 30 days, 16 known versions, newest CVE from 2026-10-08. Vendor: Broadcom.
CVEs of Brocade Active Support Connectivity Gateway
- CVE-2026-87428 - CVSS 8.4 (high), 2026-10-08: In Brocade ASCG before 3.5.0, a local unauthorized user on the ASCG VM who can issue a request to the SANnav host network namespace can extract stored…
- CVE-2026-87426 - CVSS 5.3 (medium), 2026-10-08: An unauthenticated network-based attacker can query specific internal management endpoints on Brocade ASCG versions before 3.5.0 to enumerate the…
- CVE-2026-87425 - CVSS 7.6 (high), 2026-10-08: An unauthenticated remote attacker can modify the TLS client trust store in Brocade ASCG versions before 3.5.0. By supplying an unauthorized Certificate…
- CVE-2026-87424 - CVSS 8.8 (high), 2026-10-08: A vulnerability in the SupportLink API authentication component of Brocade ASCG versions prior to 3.5.0 allows an attacker to bypass authentication across…
- CVE-2026-85490 - CVSS 8.8 (high), 2026-10-08: When Brocade ASCG before 3.5.0 processes support bundle archives ingested from remote compromised endpoints, the application fails to sanitize path traversal…
- CVE-2026-85489 - CVSS 8.8 (high), 2026-10-08: An authentication flaw exists in the Brocade ASCG administrative management service component. An unauthenticated network user can issue direct API requests…
- CVE-2026-85488 - CVSS 7.8 (high), 2026-10-08: Brocade ASCG before 3.5.0 has a well-known Brocade default password embedded in a script distributed to every customer. Any local authenticated user with read…
- CVE-2026-85487 - CVSS 8.8 (high), 2026-10-08: A path traversal vulnerability exists in the HTTP service component of Brocade ASCG versions before 3.5.0. An unauthenticated attacker on the local network…
- CVE-2026-85486 - CVSS 8.6 (high), 2026-10-08: Brocade ASCG before 3.5.0 improperly processes user input by evaluating form data prior to validation. When an authenticated user submits a configuration…
- CVE-2026-85423 - CVSS 8.8 (high), 2026-10-08: A vulnerability has been identified in the data collection service of Brocade ASCG versions before 3.5.0. An API endpoint within the data collector service…
- CVE-2026-85422 - CVSS 8.4 (high), 2026-10-08: A vulnerability in Brocade ASCG version before 3.5.0 could allow an attacker to obtain a static cryptographic key hardcoded into the software binaries to…
- CVE-2026-85421 - CVSS 8.8 (high), 2026-10-08: A critical security vulnerability has been identified in Brocade ASCG versions before 3.5.0. The HTTPS service fails to properly enforce authentication or…
- CVE-2023-5649 - CVSS 6.8 (medium), 2026-10-08: An Improper Input Validation vulnerability for the registered case credentials in Brocade ASCG before v3.0 could allow a local authenticated user to provide…
- CVE-2023-5648 - CVSS 6.5 (medium), 2026-10-08: In Brocade ASCG before Brocade ASCG v3.0, several security-related HTTP Headers were missing in various Brocade ASCG URL paths, aiding unauthenticated…
- CVE-2026-0869 - CVSS 8.8 (high), 2026-03-03: Authentication bypass in Brocade ASCG 3.4.0 Could allow an unauthorized user to perform ASCG operations related to Brocade Support Link(BSL) and streaming…
- CVE-2025-7398 - CVSS 9.1 (critical), 2025-07-17: Brocade ASCG before 3.3.0 allows for the use of medium strength cryptography algorithms on internal ports ports 9000 and 8036.
- CVE-2025-6391 - CVSS 9.1 (critical), 2025-07-17: Brocade ASCG before 3.3.0 logs JSON Web Tokens (JWT) in log files. An attacker with access to the log files can withdraw the unencrypted tokens with security…
- CVE-2024-1509 - CVSS 9.1 (critical), 2025-02-28: Brocade ASCG before 3.2.0 Web Interface is not enforcing HSTS, as defined by RFC 6797. HSTS is an optional response header that can be configured on the…
