CVE-2026-85421 is a high severity missing authentication flaw in Brocade ASCG before 3.5.0. The HTTPS service does not enforce access control, so an unauthenticated attacker on the adjacent network could issue control commands and change configuration. Upgrade to version 3.5.0 or later.
What's affected
- Product: Brocade Active Support Connectivity Gateway (ASCG), also written Brocade ASCG.
- Affected: versions before 3.5.0.
- Fixed: 3.5.0 or later is the target the record implies. The Broadcom advisory (38378) is the vendor source, but its page needs JavaScript and did not load when I fetched it, so confirm the fixed version there.
- Attack path: adjacent network, no login and no user interaction (CVSS vector AV:A/AC:L/PR:N/UI:N).
Severity in the record: High, CVSS 8.8 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The record text for this CVE uses the word critical, but the CVSS score is 8.8, which is High. I use the score for the title.
Weakness class: CWE-306 (Missing Authentication for Critical Function).
How to check if you're exposed
The record gives no command line steps, so use the vendor path.
- Find the ASCG version in the appliance's administration interface or in your deployment records, and compare it with 3.5.0.
- Read Broadcom security advisory 38378 for the exact affected builds and upgrade steps.
- Look for admin or control requests to the HTTPS service from addresses that are not your management hosts.
- Confirm which networks can reach the appliance. The record rates the attack path by network position, so the segment the appliance sits on matters.
What to do now
- Upgrade Brocade ASCG to 3.5.0 or later, following Broadcom advisory 38378.
- Review the appliance configuration and cluster state for changes nobody made.
- Keep the appliance on a restricted management network and out of reach of general user networks.
- Record the upgrade date and version so you can answer an audit question quickly.
Why it matters
The record describes a service that answers control requests without checking who is asking. That is missing authentication for a critical function, CWE-306. Controls that change cluster state need identity checks on every request, not only on the login page.
Brocade ASCG has a family of eight advisories published on 8 October 2026, and this one has the broadest impact: the record says it could lead to complete compromise of the streaming service control plane. Treat it as part of a single upgrade, because 3.5.0 is named as the fixed line for all of them. The record does not mark any of them as exploited in the wild.
Quick check
Is this CVE critical or high?
The CVSS score in the record is 8.8, which is High. The description text calls it critical, so both words appear. Plan the upgrade either way.
Sources
Last reviewed: 18 October 2026.
