CVE Feed

    Dashboard / CVE / CVE-2026-87425

    CVE-2026-87425

    An unauthenticated remote attacker can modify the TLS client trust store in Brocade ASCG versions before 3.5.0. By supplying an unauthorized Certificate Authority (CA) certificate to an unauthenticated management interface, the attacker can cause the system to trust unauthorized certificates, potentially enabling Man-in-the-Middle (MITM) attacks against outbound communications with managed switches and peer nodes.

    Published:Oct 8, 2026
    Last Modified:Oct 14, 2026
    EPS:Oct 8, 2026
    EPSS Score:0.00104
    CVSS Score:6.8

    Affected Products

    Vendor
    Broadcom
    Product
    Brocade Active Support Connectivity Gateway

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-295 Improper Certificate Validation

    Related CVEs

    CVE-2026-87428 (CVSS 8.4) — In Brocade ASCG before 3.5.0, a  local unauthorized user on the ASCG VM who can issue a request to the SANnav …
    CVE-2026-87426 (CVSS 5.3) — An unauthenticated network-based attacker can query specific internal management endpoints on Brocade ASCG ver…
    CVE-2026-87424 (CVSS 8.6) — A vulnerability in the SupportLink API authentication component of Brocade ASCG versions prior to 3.5.0 allows…
    CVE-2026-85490 (CVSS 7.7) — When Brocade ASCG before 3.5.0 processes support bundle archives ingested from remote compromised endpoints, t…
    CVE-2026-85489 (CVSS 8.7) — An authentication flaw exists in the Brocade ASCG administrative management service component. An unauthentica…
    CVE-2026-85488 (CVSS 7) — Brocade ASCG before 3.5.0 has a well-known Brocade default password embedded in a script distributed to every …
    CVE-2026-85487 (CVSS 8.6) — A path traversal vulnerability exists in the HTTP service component of Brocade ASCG versions before 3.5.0. An …
    CVE-2026-85486 (CVSS 8.6) — Brocade ASCG before 3.5.0 improperly processes user input by evaluating form data prior to validation. When an…
    CVE-2026-85423 (CVSS 8.6) — A vulnerability has been identified in the data collection service of Brocade ASCG versions before 3.5.0. An A…
    CVE-2026-85422 (CVSS 8.4) — A vulnerability in Brocade ASCG version before 3.5.0 could allow an attacker to obtain a static cryptographic …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High