Signals
Back to database
Schedule46High8.4VulnerabilityCVE-2026-85422No patch link observed

CVE-2026-85422 — A vulnerability in Brocade ASCG version before 3.5.0 could allow an attacker to obtain a static cryptographic key hardcoded into the software binar…

Published Oct 8, 2026, 07:16 AM UTCIngested 14h agoSource NVD(cve-db)CVE-2026-85422

Description

A vulnerability in Brocade ASCG version before 3.5.0 could allow an attacker to obtain a static cryptographic key hardcoded into the software binaries to secure sensitive data at rest and to protect inter-node communication protocols. An attacker who extracts this key can decrypt stored management credentials or craft forged administrative synchronization messages.

CVSS v4.0 base metrics

CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
8.4

High severity

Band computed from the CVSS base score, not the source's own label — so it means the same thing across every feed.

AV

Local

Attack Vector

AC

Low

Attack Complexity

AT

None

Attack Requirements

PR

High

Privileges Required

UI

None

User Interaction

VC

High

Confidentiality (Vulnerable System)

VI

High

Integrity (Vulnerable System)

VA

High

Availability (Vulnerable System)

SC

None

Confidentiality (Subsequent System)

SI

None

Integrity (Subsequent System)

SA

None

Availability (Subsequent System)

References

Related threats

same CWE or vendor
High

CVE-2026-84250 — IBM Guardium Data Protection 12.2 is vulnerable due to weak cryptographic protection and a hard-coded recovery key in the pkcrypto passkey component.

CVE-2026-84250 · 2h ago

High

CVE-2026-85488 — Brocade ASCG before 3.5.0 has a well-known Brocade default password embedded in a script distributed to every customer.

CVE-2026-85488 · 15h ago

Medium

CVE-2026-92861 — The Android application "Ticket Ryutsu Center" contains hard-coded credentials, which may allow an attacker to obtain an API key used by the applic…

CVE-2026-92861 · 19h ago

Critical

CVE-2026-62252 — Homer is open source telecom observability software.

CVE-2026-62252 · 1d ago

High

CVE-2026-102161 — An unauthenticated attacker located on an adjacent private network (or any attacker routed through a reverse proxy/load balancer that forwards clie…

CVE-2026-102161 · 2d ago

Critical

CVE-2026-61421 — Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded Credentials vulnerability in the CSM Authorization.

CVE-2026-61421 · 2d ago