CVE-2026-85489 in Active Support Connectivity Gateway
Summary
by MITRE • 10/08/2026
An authentication flaw exists in the Brocade ASCG administrative management service component. An unauthenticated network user can issue direct API requests to perform privileged actions, including accessing sensitive system configuration mapping data, modifying managed device inventories, and altering operational settings. This vulnerability affects all versions of Brocade ASCG before 3.5.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/08/2026
The identified security deficiency resides within the administrative management service component of the Brocade Advanced Software Configuration Group, specifically affecting all software versions prior to release 3.5.0. This flaw represents a critical failure in access control mechanisms, allowing unauthenticated network users to bypass authentication requirements entirely. By exploiting this vulnerability, an attacker can issue direct application programming interface requests that are intended for privileged administrative accounts only. The absence of proper session validation or token verification enables remote actors to interact with the management plane as if they were authorized administrators, effectively nullifying the security boundary designed to protect critical infrastructure components from unauthorized access.
The technical nature of this vulnerability aligns closely with CWE-287, which describes Improper Authentication, and more specifically CWE-306, Missing Authentication for Critical Function. The operational impact is severe because it grants an unauthenticated actor full control over the management interface. Attackers can retrieve sensitive system configuration mapping data, which may reveal network topology, device identities, and security policies. Furthermore, they possess the capability to modify managed device inventories, potentially disrupting service availability or causing misconfigurations that lead to operational failures. The ability to alter operational settings allows for deeper compromise of the network environment, including changes to routing protocols, firewall rules, or system parameters that could facilitate further attacks such as denial-of-service conditions or lateral movement within the enterprise network.
From a threat intelligence perspective, this vulnerability facilitates actions categorized under MITRE ATT&CK technique T1078, Valid Accounts, and potentially T1529, System Shutdown or Reboot if operational settings allow for service disruption. The exploitation of this flaw does not require complex payload delivery or social engineering; it relies solely on the ability to reach the management interface over the network. This makes it particularly dangerous in environments where administrative interfaces are exposed to untrusted networks or lack sufficient network segmentation and access control lists.
Mitigation strategies must prioritize immediate patching to version 3.5.0 or later, which addresses these authentication flaws by enforcing strict validation of user credentials before processing any privileged API requests. In cases where immediate patching is not feasible due to operational constraints, organizations should implement robust network-level controls such as restricting access to the management interface exclusively through trusted IP ranges using firewalls or virtual private networks. Additionally, deploying intrusion detection systems with signatures capable of identifying anomalous administrative traffic patterns can provide an additional layer of defense by alerting security operations centers to unauthorized API calls originating from unauthenticated sources. Regular auditing of administrative logs and enforcing multi-factor authentication for all management interfaces are also recommended best practices to reduce the risk surface associated with such vulnerabilities.