Sensitive Credential Exposure via Unredacted REST Endpoint Response in Brocade ASCG before 3.5.0 (CVE-2026-87428)
38390
02 October 2026
02 October 2026
CLOSED
HIGH
8.4 - CVSS v4.0 Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
CVE-2026-87428
|
Brocade Security Advisory ID |
BSA-2026-3973 |
|
Component |
ServerHandler |
|
|
|
CWE-522: Insufficiently Protected Credentials / CWE-312: Cleartext Storage of Sensitive Information
Summary
In Brocade ASCG before 3.5.0, a local unauthorized user on the ASCG VM who can issue a request to the SANnav host network namespace can extract stored management credentials for onboarded SANnav instances and compromise connected Brocade SANnav servers or managed Brocade Fibre Channel switches.
Products Affected
Brocade ASCG Standard deployment before ASCG 3.5.0
Solution
A security update is provided in Brocade ASCG 3.5.0
Notes
This is a Frontier AI discovered vulnerability.
Revision History
|
Version |
Change |
Date |
|
1.0 |
Initial Publication |
Sept 09, 2026 |
Disclaimer
THIS DOCUMENT IS PROVIDED ON AN AS-IS BASIS SOLELY FOR INFORMATIONAL PURPOSES AND DOES NOT IMPLY ANY KIND OF GUARANTY OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. YOUR USE OF THE INFORMATION CONTAINED HEREIN IS AT YOUR OWN RISK. ALL INFORMATION PROVIDED HEREIN IS BASED ON BROCADE'S CURRENT KNOWLEDGE AND UNDERSTANDING OF THE VULNERABILITY AND IMPACT TO BROCADE HARDWARE AND SOFTWARE PRODUCTS. BROCADE RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.