Signals
Back to database
Schedule39High7.0VulnerabilityCVE-2026-85488No patch link observed

CVE-2026-85488 — Brocade ASCG before 3.5.0 has a well-known Brocade default password embedded in a script distributed to every customer.

Published Oct 8, 2026, 07:16 AM UTCIngested 14h agoSource NVD(cve-db)CVE-2026-85488

Description

Brocade ASCG before 3.5.0 has a well-known Brocade default password embedded in a script distributed to every customer. Any local authenticated user with read access to the installation path can discover this credential and perform privilege escalation on affected Open Virtual Appliance (OVA) deployments, where default configuration settings remain in place.

CVSS v4.0 base metrics

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
7.0

High severity

Band computed from the CVSS base score, not the source's own label — so it means the same thing across every feed.

AV

Local

Attack Vector

AC

Low

Attack Complexity

AT

None

Attack Requirements

PR

Low

Privileges Required

UI

Passive

User Interaction

VC

High

Confidentiality (Vulnerable System)

VI

High

Integrity (Vulnerable System)

VA

High

Availability (Vulnerable System)

SC

None

Confidentiality (Subsequent System)

SI

None

Integrity (Subsequent System)

SA

None

Availability (Subsequent System)

References

Related threats

same CWE or vendor
High

CVE-2026-84250 — IBM Guardium Data Protection 12.2 is vulnerable due to weak cryptographic protection and a hard-coded recovery key in the pkcrypto passkey component.

CVE-2026-84250 · 2h ago

High

CVE-2026-85422 — A vulnerability in Brocade ASCG version before 3.5.0 could allow an attacker to obtain a static cryptographic key hardcoded into the software binar…

CVE-2026-85422 · 15h ago

Medium

CVE-2026-92861 — The Android application "Ticket Ryutsu Center" contains hard-coded credentials, which may allow an attacker to obtain an API key used by the applic…

CVE-2026-92861 · 19h ago

Critical

CVE-2026-62252 — Homer is open source telecom observability software.

CVE-2026-62252 · 1d ago

High

CVE-2026-102161 — An unauthenticated attacker located on an adjacent private network (or any attacker routed through a reverse proxy/load balancer that forwards clie…

CVE-2026-102161 · 2d ago

Critical

CVE-2026-61421 — Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded Credentials vulnerability in the CSM Authorization.

CVE-2026-61421 · 2d ago