CVE-2026-87426 in Active Support Connectivity Gateway
Summary
by MITRE • 10/08/2026
An unauthenticated network-based attacker can query specific internal management endpoints on Brocade ASCG versions before 3.5.0 to enumerate the configuration details and state of managed Brocade Fabric OS (FOS) switches. This results in the unauthorized disclosure of the customer's SAN fabric management topology and switch connectivity attributes.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified involves a critical authentication bypass within the network management interface of Brocade Advanced Switching Configuration Group versions prior to 3.5.0. Specifically, certain internal endpoints designed for administrative oversight lack proper access controls, allowing unauthenticated actors on the same network segment or with routed access to query these interfaces directly. This flaw enables an attacker to retrieve sensitive configuration data and real-time state information from managed Brocade Fabric OS switches without providing valid credentials. The absence of authentication checks at this layer represents a fundamental failure in implementing secure design principles for management planes, exposing critical infrastructure details to any entity capable of reaching the affected network path.
From a technical perspective, the exploitation mechanism relies on direct HTTP or API requests targeting specific internal URLs that are intended only for authenticated administrative sessions. By sending these queries, an attacker can extract detailed topology maps, including switch serial numbers, port configurations, zoning information, and active fabric membership details. This data reveals how storage area network components interconnect, which devices are online, and the logical structure of the SAN environment. The vulnerability is classified under CWE-287 Improper Authentication because the system fails to verify user identity before granting access to sensitive management resources. Additionally, it aligns with CWE-1065 API Without Endpoint Authorization as specific endpoints within the application programming interface are exposed without requiring authorization tokens or session validation.
The operational impact of this vulnerability is severe due to the sensitivity of storage area network architecture information. The unauthorized disclosure of SAN fabric topology allows an attacker to map out the entire infrastructure, identifying critical servers, storage arrays, and inter-switch links. This intelligence can be leveraged for further attacks such as targeted denial-of-service operations against specific switches or ports, manipulation of zoning configurations if additional vulnerabilities are present, or planning physical access attacks based on device locations inferred from management data. The exposure also violates confidentiality requirements in many regulatory frameworks by revealing proprietary infrastructure layouts and potentially sensitive data paths used for business-critical applications.
In the context of cyber threat intelligence, this vulnerability facilitates reconnaissance activities consistent with MITRE ATT&CK technique T1087 Endpoint Discovery where attackers gather information about local systems and network topology. It also supports T1526 Cloud Service Discovery if the management interface is accessible via cloud-managed networks, although in this case it primarily affects on-premises SAN environments. The ability to enumerate configuration details without authentication significantly lowers the barrier for entry, allowing less sophisticated attackers to gain valuable insights into enterprise storage infrastructure that would otherwise require deep network penetration or compromised credentials.
Mitigation strategies must prioritize immediate patching of all affected Brocade ASCG instances to version 3.5.0 or later where these internal endpoints are properly secured with authentication requirements. In environments where upgrading is not immediately feasible, network segmentation should be implemented to restrict access to the management interfaces exclusively from trusted administrative subnets using firewalls and VLAN isolation. Additionally, deploying intrusion detection systems configured to monitor for unusual HTTP requests targeting known vulnerable endpoint patterns can provide early warning of exploitation attempts. Regular audits of exposed services and enforcement of strict access control lists on all management planes are essential to prevent similar authentication bypass vulnerabilities in the future.