EUVD-2026-85553
GHSA-xxxm-64qp-rj4w
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description states a local low-privileged host user (AV:L, PR:L); commands cross into separately-authorized Fabric OS switches, giving scope change (S:C) with high triad impact.
Primary rating from Vendor (brocade).
CVSS VectorVendor: brocade
Lifecycle Timeline
3DescriptionCVE.org
Insecure access controls on internal service ports in Brocade SANnav versions before 3.0.1a allow local, non-administrative host users to communicate directly with backend management services. A local attacker can leverage this exposed access to transmit commands to connected Fabric OS switches under the security context of the SANnav management user.
AnalysisAI
Brocade SANnav deployments running versions before 3.0.1a expose backend management service ports without adequate access controls, so a local, non-administrative user on the SANnav host can talk directly to those services and relay commands to interconnected Fabric OS switches under the SANnav management user's identity. Exploitation is access-gated: it requires an authenticated low-privileged account on the host (PR:L, consistent across both the vendor CVSS 4.0 vector and our assessed CVSS:3.1 vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) plus a SANnav instance that is actively managing switches, but where those conditions hold, impact is high across confidentiality, integrity and availability with a changed scope because the attacker's authority crosses from the host user into the managed switch fabric. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a local, non-administrative user account on the Brocade SANnav management host running a version before 3.0.1a; from there the attacker communicates directly with backend management service ports that are exposed without adequate access controls. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but access-gated privilege/scope escalation flaw, not an internet-facing critical. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The documented fix is to upgrade Brocade SANnav to 3.0.1a or later, per the vendor advisory (https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38993); that advisory is also the authoritative source for confirming patch availability for your specific platform and build, so verify the fixed release against it before closing out. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Brocade SANnav deployment and confirm the running version, then treat any instance below 3.0.1a that is actively managing Fabric OS switches as in-scope; if the instance is not essential to operations, take it offline until remediated. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Incomplete log sanitization in Brocade SANnav before 3.0.1a causes extension switch IPsec pre-shared keys (PSKs) to be w
In Brocade SANnav before Brocade SANnav 2.2.0, multiple endpoints associated with Zone management are susceptible to SQL
A vulnerability in the role-based access control (RBAC) functionality of the Brocade SANNav before 2.2.0 could allow an
Command injection in the Brocade SANnav CLI scripting component lets an authenticated user who already holds command-exe
Pre-shared keys used for IPsec tunnel configuration are recorded in cleartext inside application log files by Brocade SA
Plaintext disclosure of administrative switch credentials and live session tokens in Brocade SANnav discovery-service lo
A vulnerability in the migration script for Brocade SANnav before 3.0 could allow the collection of database sql queries
In Brocade SANnav before Brocade SANnav v2.2.0.2 and Brocade SANnav2.1.1.8, encoded scp-server passwords are stored usin
In Brocade SANnav version before SANN2.2.0.2 and Brocade SANNav before 2.1.1.8, the implementation of TLS/SSL Server Sup
In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehas
Cleartext credential exposure in the job scheduling component of Brocade SANnav causes external server passwords and arc
A vulnerability in update-reports-purge-settings.sh script logging for Brocade SANnav before 2.4.0a could allow the coll
Same weakness CWE-284 – Improper Access Control
View allShare
External POC / Exploit Code
Leaving vuln.today