Signals
Back to database
Schedule48High8.7VulnerabilityCVE-2026-85489No patch link observed

CVE-2026-85489 — An authentication flaw exists in the Brocade ASCG administrative management service component.

Published Oct 8, 2026, 07:16 AM UTCIngested 14h agoSource NVD(cve-db)CVE-2026-85489

Description

An authentication flaw exists in the Brocade ASCG administrative management service component. An unauthenticated network user can issue direct API requests to perform privileged actions, including accessing sensitive system configuration mapping data, modifying managed device inventories, and altering operational settings. This vulnerability affects all versions of Brocade ASCG before 3.5.0.

CVSS v4.0 base metrics

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
8.7

High severity

Band computed from the CVSS base score, not the source's own label — so it means the same thing across every feed.

AV

Adjacent

Attack Vector

AC

Low

Attack Complexity

AT

None

Attack Requirements

PR

None

Privileges Required

UI

None

User Interaction

VC

High

Confidentiality (Vulnerable System)

VI

High

Integrity (Vulnerable System)

VA

Low

Availability (Vulnerable System)

SC

None

Confidentiality (Subsequent System)

SI

None

Integrity (Subsequent System)

SA

None

Availability (Subsequent System)

References

Related threats

same CWE or vendor
Critical

CVE-2026-84272 — IBM Guardium Data Protection 12.1 and 12.2.2 are vulnerable to missing authentication in the edge-controller component.

CVE-2026-84272 · 2h ago

Critical

CVE-2026-104076 — TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain a missing authentication vulnerability that allows remote una…

CVE-2026-104076 · 2h ago

High

PraisonAI: Call API localhost-only authentication bypass via spoofed Host header

CVE-2026-61435 · 3h ago

Critical

CVE-2026-9209 — mJobTime through build 15.7.3.32 contains an unauthenticated SQL execution vulnerability in the Login.aspx admin panel handlers, where the runQuery…

CVE-2026-9209 · 7h ago

Critical

CVE-2026-105110 — OS Command Injection in the login.xgi CGI endpoint in Iskratel Innbox GPON ONT devices allows an unauthenticated remote attacker to execute arbitra…

CVE-2026-105110 · 13h ago

High

CVE-2026-85423 — A vulnerability has been identified in the data collection service of Brocade ASCG versions before 3.5.0.

CVE-2026-85423 · 15h ago