CVE-2026-87428 is a high severity credential exposure flaw in Brocade ASCG before 3.5.0. A local unauthorized user on the ASCG VM can send a request to the SANnav host network namespace and extract stored management credentials, then compromise SANnav servers or switches. The record gives 3.5.0 as the fix.
What's affected
Affected: Brocade ASCG before 3.5.0. Fixed in 3.5.0, per the record. Broadcom publishes the advisory behind a browser check that my automated fetch could not pass, so the vendor page itself was not read. The details below come from the record, which cites it. Read the advisory for the full affected list, fixed versions and any workaround before acting.
The record scores it CVSS 3.1 7.8 (High), which fits a local attacker with high impact. I had no second score. The record does not mark exploitation and the CVE is not in CISA KEV.
How to check if you're exposed
Brocade Active Support Connectivity Gateway (ASCG) is a virtual appliance. Read the installed version from the appliance's management interface and compare it with 3.5.0, the fixed version in the record.
Also list which SANnav instances are onboarded to the gateway. Both ASCG advisories in this batch concern what the gateway can do to, or reveal about, connected SANnav servers and the switches they manage, so the blast radius is every system onboarded to it.
If you cannot read the version, treat the gateway as affected and ask Broadcom support for the correct upgrade path.
Because the attacker is local on the VM, also review who has shell or console access to the ASCG virtual machine and to its hypervisor.
What to do now
- Read the Broadcom security advisory and confirm the fixed version for your product and platform.
- Inventory every affected instance, including copies in lab, test and disaster recovery sites.
- Schedule the upgrade, with a rollback plan, since these systems sit in storage network management.
- Limit management network access to administrators and jump hosts while you wait.
- Record versions in your asset inventory and subscribe to Broadcom security advisories for the product.
Why it matters
The weakness is insufficiently protected credentials (CWE-522). The record says management credentials for onboarded SANnav instances are stored in a way that a local user on the VM can obtain by asking through a network namespace that reaches the SANnav host. The danger is not the gateway itself. It is what the stolen credentials open up: SANnav servers and the Fibre Channel switches they manage.
Local access is the limiting condition. An attacker needs to be on the VM already, whether through a stolen account, another vulnerability or an insider. That makes this a second stage flaw: harmless on its own, serious after a first foothold.
The remedy is the upgrade, plus the usual hygiene of limiting VM access and rotating the credentials that ASCG stores for SANnav if you believe someone without authority had local access.
Quick check
Can this be exploited remotely?
The record describes a local unauthorized user on the ASCG VM, so some prior access is needed.
Should I rotate credentials?
If untrusted people could have had local access to the VM, yes. After upgrading, rotate the SANnav credentials stored on the gateway.
Sources
- Broadcom security advisory 38390 (cited by the record; not readable by my automated fetch)
- Safeguard Gold entry for CVE-2026-87428
Last reviewed: 18 October 2026.
