CVE-2026-85487 is a high severity path traversal flaw in the HTTP service of Brocade ASCG before 3.5.0. An unauthenticated attacker on the local network could send a manipulated API request to read, write or delete arbitrary files. Upgrade to version 3.5.0 or later.
What's affected
- Product: Brocade Active Support Connectivity Gateway (ASCG), also written Brocade ASCG.
- Affected: versions before 3.5.0.
- Fixed: 3.5.0 or later is the target the record implies. The Broadcom advisory (38383) is the vendor source, but its page needs JavaScript and did not load when I fetched it, so confirm the fixed version there.
- Attack path: adjacent network, no login and no user interaction (CVSS vector AV:A/AC:L/PR:N/UI:N).
Severity in the record: High, CVSS 8.8 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Weakness class: CWE-22 (Path Traversal).
How to check if you're exposed
The record gives no command line steps, so use the vendor path.
- Find the ASCG version in the appliance's administration interface or in your deployment records, and compare it with 3.5.0.
- Read Broadcom security advisory 38383 for the exact affected builds and upgrade steps.
- Look in web service logs for API requests that contain unusual path segments, and for files that changed without an administrator action.
- Confirm which networks can reach the appliance. The record rates the attack path by network position, so the segment the appliance sits on matters.
What to do now
- Upgrade Brocade ASCG to 3.5.0 or later, following Broadcom advisory 38383.
- Check the appliance for modified or missing files, and compare configuration with a known good backup.
- Keep the appliance on a restricted management network and out of reach of general user networks.
- Record the upgrade date and version so you can answer an audit question quickly.
Why it matters
Path traversal means a request names a file in a way that escapes the folder the service meant to serve. It is CWE-22, a long standing weakness. Here there is no login to stand in the way, so reach is decided by who is on the network.
Read access can leak configuration and credentials, write access can plant files that later run, and delete access can break the appliance. That is why all three impacts are rated High. Fixes are well known: resolve the path and confirm it stays inside an allowed root. Until you upgrade, keep the service off networks where untrusted devices live. No exploitation in the wild is claimed in the record.
Quick check
What can the attacker do with this flaw?
The record says arbitrary file read, write or deletion. The effect depends on which files the service account can reach.
Sources
Last reviewed: 18 October 2026.
