Brocade SANnav CVE-2026-5048

Requires an authenticated attacker with low privileges (PR:L) and adjacent-network access (AV:A) to the SANnav management plane; it is not remote-unauthenticated. The attacker must reach the affected external API inventory REST endpoints and supply malicious values in specific query parameters that are unsafely used in SQL queries. Limiting factors: valid credentials are needed, exposure is limited to adjacent/management network rather than the open internet, and only SANnav versions before 3.0.0a are affected (upgrade to 3.0.0a remediates). No user interaction is required (UI:N).

This is a moderate-severity, authenticated SQL injection (CWE-89) in Brocade SANnav, rated 6.1 by the vendor using CVSS 4.0. The signals point to a real but constrained risk rather than an urgent fire. The vendor-supplied CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:L/UI:N) requires adjacent-network access and low-privilege authentication, which already narrows the attacker population to someone with a foothold on the management network and valid credentials. Notably, the vector reports NO vulnerable-system impact (VC:N/VI:N/VA:N) yet a HIGH subsequent-system confidentiality impact (SC:H) - an unusual profile implying the injection yields data disclosure against a downstream/backend system (e.g., the SANnav database) rather than compromising the SANnav application itself; this nuance should be verified with Broadcom. No EPSS score, CISA KEV listing, or POC was provided in the input, so there is no evidence of active exploitation or public exploit code. Overall this reads as a genuine but lower-priority issue for most defenders: patch in the normal cycle unless SANnav management interfaces are exposed to untrusted adjacent networks.

An attacker who has already obtained low-privilege authenticated access to the SANnav management interface, and who sits on an adjacent network segment, sends crafted values in REST API query parameters to one of the external API inventory endpoints. The malicious input is concatenated into a backend SQL query, allowing the attacker to manipulate the query and extract data from the backend database. No public proof-of-concept was identified in the provided data.