CVE-2026-87426

An unauthenticated network-based attacker can query specific internal management endpoints on Brocade ASCG versions before 3.5.0 to enumerate the configuration details and state of managed Brocade Fabric OS (FOS) switches. This results in the unauthorized disclosure of the customer's SAN fabric management topology and switch connectivity attributes.

CVSS 4.0

5.3CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

4.3CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.1% chance of exploitation in the next 30 days; higher than 3% of CVEs (scores of 2026-10-25)

CWE

CWE-200

Published

2026-10-08

Modified

2026-10-14

Record from

the NVD, synced 2026-10-19

Affected

• broadcom:brocade_active_support_connectivity_gateway

References

• https://support.broadcom.com/external/content/SecurityAdvisories/0/38393

Check your stackJSON