Vulnerability · Published Oct 8, 2026 · Assigned by brocade

CVE-2026-85488

High 7.0

In plain English

A high-severity hard-coded credentials in Brocade Active Support Connectivity Gateway from Brocade. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities).

Severity (CVSS 4.0)7.0High

Exploit odds (30 days)<0.1%top 99.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Brocade ASCG before 3.5.0 has a well-known Brocade default password embedded in a script distributed to every customer. Any local authenticated user with read access to the installation path can discover this credential and perform privilege escalation on affected Open Virtual Appliance (OVA) deployments, where default configuration settings remain in place.

Affected products (as reported)

Vendor	Product	Versions
Brocade	Brocade Active Support Connectivity Gateway	0 – before 3.5.0

Weakness: CWE-798 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://support.broadcom.com/external/content/SecurityAdvisories/0/38384