Broadcom Brocade Active Support Connectivity Gateway
18 CVEs affecting Broadcom Brocade Active Support Connectivity Gateway. Latest disclosed: 2026-10-08. Critical: 3, High: 11.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-7398 | Critical | 9.1 | 2025-07-17 | Brocade ASCG before 3.3.0 allows for the use of medium strength cryptography algorithms on internal ports ports 9000 and 8036. |
CVE-2025-6391 | Critical | 9.1 | 2025-07-17 | Brocade ASCG before 3.3.0 logs JSON Web Tokens (JWT) in log files. An attacker with access to the log files can withdraw the unencrypted tokens with securit… |
CVE-2024-1509 | Critical | 9.1 | 2025-02-28 | Brocade ASCG before 3.2.0 Web Interface is not enforcing HSTS, as defined by RFC 6797. HSTS is an optional response header that can be configured on the ser… |
CVE-2026-87424 | High | 8.8 | 2026-10-08 | A vulnerability in the SupportLink API authentication component of Brocade ASCG versions prior to 3.5.0 allows an attacker to bypass authentication across depl… |
CVE-2026-85490 | High | 8.8 | 2026-10-08 | When Brocade ASCG before 3.5.0 processes support bundle archives ingested from remote compromised endpoints, the application fails to sanitize path traversal s… |
CVE-2026-85489 | High | 8.8 | 2026-10-08 | An authentication flaw exists in the Brocade ASCG administrative management service component. An unauthenticated network user can issue direct API requests to… |
CVE-2026-85487 | High | 8.8 | 2026-10-08 | A path traversal vulnerability exists in the HTTP service component of Brocade ASCG versions before 3.5.0. An unauthenticated attacker on the local network cou… |
CVE-2026-85423 | High | 8.8 | 2026-10-08 | A vulnerability has been identified in the data collection service of Brocade ASCG versions before 3.5.0. An API endpoint within the data collector service fai… |
CVE-2026-85421 | High | 8.8 | 2026-10-08 | A critical security vulnerability has been identified in Brocade ASCG versions before 3.5.0. The HTTPS service fails to properly enforce authentication or acce… |
CVE-2026-0869 | High | 8.8 | 2026-03-03 | Authentication bypass in Brocade ASCG 3.4.0 Could allow an unauthorized user to perform ASCG operations related to Brocade Support Link(BSL) and streaming conf… |
CVE-2026-85486 | High | 8.0 | 2026-10-08 | Brocade ASCG before 3.5.0 improperly processes user input by evaluating form data prior to validation. When an authenticated user submits a configuration form… |
CVE-2026-87428 | High | 7.8 | 2026-10-08 | In Brocade ASCG before 3.5.0, a local unauthorized user on the ASCG VM who can issue a request to the SANnav host network namespace can extract stored managem… |
CVE-2026-85488 | High | 7.8 | 2026-10-08 | Brocade ASCG before 3.5.0 has a well-known Brocade default password embedded in a script distributed to every customer. Any local authenticated user with read… |
CVE-2026-85422 | High | 7.8 | 2026-10-08 | A vulnerability in Brocade ASCG version before 3.5.0 could allow an attacker to obtain a static cryptographic key hardcoded into the software binaries to secur… |
CVE-2026-87425 | Medium | 6.8 | 2026-10-08 | An unauthenticated remote attacker can modify the TLS client trust store in Brocade ASCG versions before 3.5.0. By supplying an unauthorized Certificate Author… |
CVE-2023-5648 | Medium | 6.1 | 2026-10-08 | In Brocade ASCG before Brocade ASCG v3.0, several security-related HTTP Headers were missing in various Brocade ASCG URL paths, aiding unauthenticated attacker… |
CVE-2023-5649 | Medium | 5.5 | 2026-10-08 | An Improper Input Validation vulnerability for the registered case credentials in Brocade ASCG before v3.0 could allow a local authenticated user to provide in… |
CVE-2026-87426 | Medium | 4.3 | 2026-10-08 | An unauthenticated network-based attacker can query specific internal management endpoints on Brocade ASCG versions before 3.5.0 to enumerate the configuration… |