CVE-2026-87424 is a high severity authentication bypass in the SupportLink API of Brocade Active Support Connectivity Gateway (ASCG) before 3.5.0. A hard-coded cryptographic key lets an attacker bypass authentication across deployments. The record points to Brocade ASCG 3.5.0 as the fixed version.
What's affected
Affected: Brocade ASCG versions prior to 3.5.0, component SupportLink API authentication. Fixed in 3.5.0, per the record. Broadcom publishes the advisory behind a browser check that my automated fetch could not pass, so the vendor page itself was not read. The details below come from the record, which cites it. Read the advisory for the full affected list, fixed versions and any workaround before acting.
The record scores it CVSS 3.1 8.8 (High). I could not compare against a second source. The record does not mark exploitation and the CVE is not in CISA KEV.
How to check if you're exposed
Brocade Active Support Connectivity Gateway (ASCG) is a virtual appliance. Read the installed version from the appliance's management interface and compare it with 3.5.0, the fixed version in the record.
Also list which SANnav instances are onboarded to the gateway. Both ASCG advisories in this batch concern what the gateway can do to, or reveal about, connected SANnav servers and the switches they manage, so the blast radius is every system onboarded to it.
If you cannot read the version, treat the gateway as affected and ask Broadcom support for the correct upgrade path.
What to do now
- Read the Broadcom security advisory and confirm the fixed version for your product and platform.
- Inventory every affected instance, including copies in lab, test and disaster recovery sites.
- Schedule the upgrade, with a rollback plan, since these systems sit in storage network management.
- Limit management network access to administrators and jump hosts while you wait.
- Record versions in your asset inventory and subscribe to Broadcom security advisories for the product.
Why it matters
The weakness is use of a hard-coded cryptographic key (CWE-321). When the same secret ships in every copy of a product, anyone who obtains it from one copy, or from the software itself, can use it against all of them. The record says the bypass works "across deployments", which is the usual consequence.
A key baked into software cannot be rotated by the customer, so the only remedy is a vendor update. That is why this is an upgrade item, not a configuration item.
For a gateway that connects storage management systems to vendor support services, an authentication bypass in the API that handles support connectivity is a concern. Treat the version upgrade as a priority, and limit network reach to the gateway until it is done.
Quick check
Why is a hard-coded key worse than a weak password?
You can change a weak password. A key embedded in the product is shared by every deployment and only the vendor can replace it.
Which version should I run?
The record says versions before 3.5.0 are affected. Confirm in the Broadcom advisory.
Sources
- Broadcom security advisory 38391 (cited by the record; not readable by my automated fetch)
- Safeguard Gold entry for CVE-2026-87424
Last reviewed: 18 October 2026.
