Signals
Back to database
Schedule47High8.6VulnerabilityCVE-2026-85423No patch link observed

CVE-2026-85423 — A vulnerability has been identified in the data collection service of Brocade ASCG versions before 3.5.0.

Published Oct 8, 2026, 07:16 AM UTCIngested 14h agoSource NVD(cve-db)CVE-2026-85423

Description

A vulnerability has been identified in the data collection service of Brocade ASCG versions before 3.5.0. An API endpoint within the data collector service fails to perform authentication or authorization checks on incoming requests. An attacker with network access to the service can instruct the application to establish SSH connections to arbitrary hosts and execute arbitrary system commands, effectively turning the appliance into an unauthenticated proxy or execution vector.

CVSS v4.0 base metrics

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
8.6

High severity

Band computed from the CVSS base score, not the source's own label — so it means the same thing across every feed.

AV

Adjacent

Attack Vector

AC

Low

Attack Complexity

AT

None

Attack Requirements

PR

None

Privileges Required

UI

None

User Interaction

VC

High

Confidentiality (Vulnerable System)

VI

High

Integrity (Vulnerable System)

VA

None

Availability (Vulnerable System)

SC

None

Confidentiality (Subsequent System)

SI

None

Integrity (Subsequent System)

SA

None

Availability (Subsequent System)

References

Related threats

same CWE or vendor
Critical

CVE-2026-84272 — IBM Guardium Data Protection 12.1 and 12.2.2 are vulnerable to missing authentication in the edge-controller component.

CVE-2026-84272 · 2h ago

Critical

CVE-2026-104076 — TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain a missing authentication vulnerability that allows remote una…

CVE-2026-104076 · 2h ago

High

PraisonAI: Call API localhost-only authentication bypass via spoofed Host header

CVE-2026-61435 · 3h ago

Critical

CVE-2026-9209 — mJobTime through build 15.7.3.32 contains an unauthenticated SQL execution vulnerability in the Login.aspx admin panel handlers, where the runQuery…

CVE-2026-9209 · 7h ago

Critical

CVE-2026-105110 — OS Command Injection in the login.xgi CGI endpoint in Iskratel Innbox GPON ONT devices allows an unauthenticated remote attacker to execute arbitra…

CVE-2026-105110 · 13h ago

High

CVE-2026-85489 — An authentication flaw exists in the Brocade ASCG administrative management service component.

CVE-2026-85489 · 15h ago