CVE-2026-85486 is a high severity code injection flaw in Brocade ASCG before 3.5.0. The application evaluates configuration form data before validating it, so an authenticated user with basic access can supply input that runs as code on the server. Upgrade to version 3.5.0 or later.
What's affected
- Product: Brocade Active Support Connectivity Gateway (ASCG), also written Brocade ASCG.
- Affected: versions before 3.5.0.
- Fixed: 3.5.0 or later is the target the record implies. The Broadcom advisory (38381) is the vendor source, but its page needs JavaScript and did not load when I fetched it, so confirm the fixed version there.
- Attack path: adjacent network, low privileges, no user interaction (CVSS vector AV:A/AC:L/PR:L/UI:N).
Severity in the record: High, CVSS 8.0 (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Weakness class: CWE-95 (Eval Injection).
How to check if you're exposed
The record gives no command line steps, so use the vendor path.
- Find the ASCG version in the appliance's administration interface or in your deployment records, and compare it with 3.5.0.
- Read Broadcom security advisory 38381 for the exact affected builds and upgrade steps.
- List the accounts that can submit configuration forms. Even basic accounts count here.
- Confirm which networks can reach the appliance. The record rates the attack path by network position, so the segment the appliance sits on matters.
What to do now
- Upgrade Brocade ASCG to 3.5.0 or later, following Broadcom advisory 38381.
- Remove or disable accounts that are no longer needed, and review who holds basic access.
- Keep the appliance on a restricted management network and out of reach of general user networks.
- Record the upgrade date and version so you can answer an audit question quickly.
Why it matters
The root cause is an order of operations error: input is processed first and checked later. Anything that passes user text into an evaluator before validation is open to injection. The record calls it eval injection, CWE-95.
The privilege needed is low, since any authenticated user who can submit a configuration form can reach it. That is why the account list matters, and why shared credentials are a risk. Validate first, never evaluate untrusted text, and give form users the narrowest role. The record does not mark this as exploited in the wild.
Quick check
Who can reach this flaw?
Any authenticated user who can submit a configuration form, according to the record. It does not require administrator rights.
Sources
Last reviewed: 18 October 2026.
