CVE-2026-85489 is a high severity authentication flaw in the administrative management service of Brocade ASCG. An unauthenticated network user can send direct API requests to read configuration mapping data, change managed device inventories and alter settings. All versions before 3.5.0 are affected. Upgrade to 3.5.0 or later.
What's affected
- Product: Brocade Active Support Connectivity Gateway (ASCG), also written Brocade ASCG.
- Affected: versions before 3.5.0.
- Fixed: 3.5.0 or later is the target the record implies. The Broadcom advisory (38388) is the vendor source, but its page needs JavaScript and did not load when I fetched it, so confirm the fixed version there.
- Attack path: adjacent network, no login and no user interaction (CVSS vector AV:A/AC:L/PR:N/UI:N).
Severity in the record: High, CVSS 8.8 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Weakness class: CWE-306 (Missing Authentication for Critical Function).
How to check if you're exposed
The record gives no command line steps, so use the vendor path.
- Find the ASCG version in the appliance's administration interface or in your deployment records, and compare it with 3.5.0.
- Read Broadcom security advisory 38388 for the exact affected builds and upgrade steps.
- Review the managed device inventory and operational settings for entries you do not recognize.
- Confirm which networks can reach the appliance. The record rates the attack path by network position, so the segment the appliance sits on matters.
What to do now
- Upgrade Brocade ASCG to 3.5.0 or later, following Broadcom advisory 38388.
- Compare the device inventory in ASCG with your asset records and remove anything unexpected.
- Keep the appliance on a restricted management network and out of reach of general user networks.
- Record the upgrade date and version so you can answer an audit question quickly.
Why it matters
This is the administrative sibling of the other missing authentication flaws in the series, and again the weakness is CWE-306. Privileged actions should require a verified identity on every call.
The inventory matters because it drives what the appliance trusts and contacts. An attacker who changes it can add a device they control or remove one you rely on. The configuration mapping data may also describe how your estate is laid out. After upgrading, reconcile the inventory against a trusted source. The record does not mark this CVE as exploited in the wild.
Quick check
Which versions are affected?
The record says all versions of Brocade ASCG before 3.5.0.
Sources
Last reviewed: 18 October 2026.
