CVE-2026-85422 is a high severity flaw in Brocade ASCG before 3.5.0. A static cryptographic key is hardcoded into the software and protects data at rest and node to node traffic. Someone who extracts it could decrypt stored management credentials. Upgrade to 3.5.0 or later and rotate secrets.
What's affected
- Product: Brocade Active Support Connectivity Gateway (ASCG), also written Brocade ASCG.
- Affected: versions before 3.5.0.
- Fixed: 3.5.0 or later is the target the record implies. The Broadcom advisory (38379) is the vendor source, but its page needs JavaScript and did not load when I fetched it, so confirm the fixed version there.
- Attack path: local, low privileges, no user interaction (CVSS vector AV:L/AC:L/PR:L/UI:N).
Severity in the record: High, CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Weakness class: CWE-798 (Use of Hard-coded Credentials).
How to check if you're exposed
The record gives no command line steps, so use the vendor path.
- Find the ASCG version in the appliance's administration interface or in your deployment records, and compare it with 3.5.0.
- Read Broadcom security advisory 38379 for the exact affected builds and upgrade steps.
- Make a list of the management credentials stored in ASCG, such as device logins, since those are what the key protects.
- Confirm which networks can reach the appliance. The record rates the attack path by network position, so the segment the appliance sits on matters.
What to do now
- Upgrade Brocade ASCG to 3.5.0 or later, following Broadcom advisory 38379.
- After upgrading, change the management credentials stored in the appliance, because the old key may have been recovered from earlier builds.
- Review who has local access to the appliance file system.
- Keep the appliance on a restricted management network and out of reach of general user networks.
- Record the upgrade date and version so you can answer an audit question quickly.
Why it matters
A key that ships inside every copy of the software is the same key for every customer. Anyone who gets one copy of the binary can learn it, so it stops protecting anything once it is found. That is use of hard coded credentials, CWE-798.
The record says an extracted key could decrypt stored management credentials or let someone craft forged administrative synchronization messages between nodes. The attack needs local access with low privileges, which limits reach, but a stored credential for a whole device estate is a prize. After you upgrade, rotate the credentials, since the key itself may already have been recovered. No exploitation in the wild is claimed.
Quick check
Does upgrading alone remove the risk?
It closes the flaw going forward. Credentials that were encrypted with the old key may still be at risk, so rotate them after the upgrade. That is a sensible precaution rather than a vendor instruction.
Sources
Last reviewed: 18 October 2026.
