CVE-2026-85423 is a high severity flaw in the data collection service of Brocade ASCG before 3.5.0. An API endpoint performs no authentication, so someone with network access can tell the appliance to open SSH connections to chosen hosts and run commands. Upgrade to version 3.5.0 or later.
What's affected
- Product: Brocade Active Support Connectivity Gateway (ASCG), also written Brocade ASCG.
- Affected: versions before 3.5.0.
- Fixed: 3.5.0 or later is the target the record implies. The Broadcom advisory (38380) is the vendor source, but its page needs JavaScript and did not load when I fetched it, so confirm the fixed version there.
- Attack path: adjacent network, no login and no user interaction (CVSS vector AV:A/AC:L/PR:N/UI:N).
Severity in the record: High, CVSS 8.8 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Weakness class: CWE-306 (Missing Authentication for Critical Function).
How to check if you're exposed
The record gives no command line steps, so use the vendor path.
- Find the ASCG version in the appliance's administration interface or in your deployment records, and compare it with 3.5.0.
- Read Broadcom security advisory 38380 for the exact affected builds and upgrade steps.
- Check the appliance and connected device logs for SSH sessions that start from the appliance to hosts you do not manage.
- Confirm which networks can reach the appliance. The record rates the attack path by network position, so the segment the appliance sits on matters.
What to do now
- Upgrade Brocade ASCG to 3.5.0 or later, following Broadcom advisory 38380.
- Review SSH logs on devices that ASCG connects to, looking for sessions that nobody scheduled.
- Keep the appliance on a restricted management network and out of reach of general user networks.
- Record the upgrade date and version so you can answer an audit question quickly.
Why it matters
Another missing authentication case, CWE-306, but with a particular twist. The service can be told to reach out to arbitrary hosts, so the appliance becomes a relay. The record calls it an unauthenticated proxy or execution vector.
That matters because the appliance probably holds trusted network position and credentials for the equipment it manages. An attacker who can steer it gains access to places that a direct connection would not reach. Segmentation helps: the data collector should only talk to known devices, and egress from the appliance should be limited. The record does not claim exploitation in the wild.
Quick check
Why is a proxy flaw serious?
Because the appliance sits inside your network and has trust that an outside attacker does not. Commands launched from it come from a trusted address.
Sources
Last reviewed: 18 October 2026.
