Brocade SANnav CVE-2026-5047

Exploitation requires the attacker to obtain SANnav log files or, specifically, the SANnav supportsave diagnostic bundle, which records encoded (reversible, not hashed) passwords and authentication tokens. The description scopes the attacker as 'authenticated ... with access to the log file,' so the gating prerequisite is file-level access to these artifacts rather than an open network request; this is reinforced by the CVSS AV:A (adjacent) and UI:P (passive user interaction, e.g. a supportsave being generated/shared). Limiting factors: affected only in SANnav versions before 2.4.0b and 3.0.0; exploitation depends on the attacker acquiring the log or supportsave output (often exported and handed to support), which is the primary real-world barrier. Note the input vector's PR:N contradicts the description's authenticated-attacker wording - confirm with the vendor.

The input assigns a CVSS 4.0 base score of 8.2 (High) with vector AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N. The high score is driven by high confidentiality impact (VC:H) plus a subsequent-system confidentiality impact (SC:H), reflecting that the leaked passwords and authentication tokens can be reused against other managed SAN systems. However, there is a direct conflict between the CVSS vector and the description: the vector encodes PR:N (no privileges required), yet the description explicitly states the flaw 'could allow an authenticated attacker with access to the log file' to access the passwords - verify the true privilege requirement with Brocade, as the practical prerequisite appears to be access to log/supportsave files rather than truly unauthenticated network access. The vector's AV:A (adjacent) and UI:P (passive user interaction) further imply the credentials are exposed via artifacts (logs, supportsave diagnostic bundles) rather than a direct remote request. No EPSS score, KEV listing, or public POC is present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net assessment: a credible credential-exposure issue (CWE-922, insecure storage) that is genuinely dangerous because passwords are merely 'encoded' (reversible) rather than hashed, but real-world risk is gated by the need to obtain log or supportsave files - making this a patch-soon priority rather than an emergency, and lower in practical urgency than the raw 8.2 suggests.

An attacker who obtains a SANnav supportsave diagnostic bundle or log files - for example an insider, or someone receiving bundles routinely exported and shared with vendor support - locates the encoded passwords and authentication tokens written to those files and decodes them. The recovered credentials can then be used to authenticate to SANnav and the managed fabric. No public POC is identified in the provided data.