CVE-2026-85490 is a high severity path traversal flaw in Brocade ASCG before 3.5.0. Support bundle archives ingested from remote endpoints are extracted without sanitizing entry paths, so a crafted archive can write files to restricted locations and may lead to code execution. Upgrade to version 3.5.0 or later.
What's affected
- Product: Brocade Active Support Connectivity Gateway (ASCG), also written Brocade ASCG.
- Affected: versions before 3.5.0.
- Fixed: 3.5.0 or later is the target the record implies. The Broadcom advisory (38389) is the vendor source, but its page needs JavaScript and did not load when I fetched it, so confirm the fixed version there.
- Attack path: adjacent network, no login and no user interaction (CVSS vector AV:A/AC:L/PR:N/UI:N).
Severity in the record: High, CVSS 8.8 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Weakness class: CWE-22 (Path Traversal).
How to check if you're exposed
The record gives no command line steps, so use the vendor path.
- Find the ASCG version in the appliance's administration interface or in your deployment records, and compare it with 3.5.0.
- Read Broadcom security advisory 38389 for the exact affected builds and upgrade steps.
- Review which remote endpoints send support bundles to the appliance, and whether any of them are outside your control.
- Confirm which networks can reach the appliance. The record rates the attack path by network position, so the segment the appliance sits on matters.
What to do now
- Upgrade Brocade ASCG to 3.5.0 or later, following Broadcom advisory 38389.
- Check the appliance for files outside the bundle extraction folder that appeared around the time of bundle uploads.
- Keep the appliance on a restricted management network and out of reach of general user networks.
- Record the upgrade date and version so you can answer an audit question quickly.
Why it matters
Unpacking an archive trusts the names inside it. If an entry name contains traversal sequences, the extractor can write outside its target unless it checks the final path. That is CWE-22, the same class as the HTTP traversal in the same release.
The record notes the attacker needs to send or intercept an ingested archive, and that code execution is possible. Support data pipelines are easy to forget because they are designed to accept files from many places. Limit who can send bundles, and keep the extraction process low privilege. The record does not claim exploitation in the wild.
Quick check
Is this the same as the HTTP path traversal?
Same class of weakness, different entry point. This one is in archive extraction, the other in the HTTP service. Version 3.5.0 is the target for both.
Sources
Last reviewed: 18 October 2026.
