Brocade SANnav CVE-2026-5049

Exploitation specifically requires use of the Zone Alias Import flow in Brocade SANnav versions before 3.0.0a, with a crafted import payload whose filename/path embeds directory-traversal sequences to escape the intended upload directory. Limiting factors: the attacker must first hold valid authenticated SANnav credentials (PR:L - not a default/anonymous flow) and, per the CVSS vector, must have adjacent-network access (AV:A) to the management interface; no user interaction is required (UI:N). Note the source conflict - the description characterizes the attacker as 'local,' which would further restrict reach to the host/segment if accurate. Impact is confined to unauthorized file write (integrity); the advisory indicates no confidentiality or availability impact.

This is a moderate-risk, authenticated integrity issue rather than a top-priority emergency. The vendor CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N) scores 6.9 (medium): low attack complexity and no attack requirements, but it requires an authenticated foothold (PR:L) and adjacent-network access (AV:A), with impact limited purely to integrity (VI:H) - no confidentiality or availability loss. There is no EPSS score, no CISA KEV listing, and no public POC in the provided data, so there is no evidence of active or widespread exploitation; this is a vendor-disclosed flaw, not an observed attack. A notable conflict exists in the source data: the CVSS vector states AV:A (adjacent network) while the text description says 'local authenticated attacker,' which would imply AV:L - verify the true attack vector with Broadcom/Brocade, as it materially changes reachability. Because exploitation presupposes valid SANnav credentials and the impact is a constrained file-write (not demonstrated RCE), real-world priority is moderate: patch in the normal cycle, prioritizing internet- or management-network-exposed SANnav instances, but it does not warrant emergency out-of-band response absent new exploitation signals.

An attacker who already holds low-privileged, authenticated access to a Brocade SANnav instance abuses the Zone Alias Import flow to upload a file whose path contains directory-traversal sequences, causing the content to be written outside the intended import directory. By landing an attacker-controlled file in a sensitive location (e.g., a web-served or configuration path), the attacker could tamper with application data or stage follow-on code execution. No public exploit is identified at time of analysis, and exploitation requires valid credentials plus adjacent-network reach per the CVSS vector.