EUVD-2026-86408
GHSA-f78x-x62p-g24f
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PSKs are read from local log files/support bundles requiring authorized read access, so AV:L and PR:L; primary impact is key confidentiality (C:H), with tunnel compromise a downstream chained effect (I/A:N here).
Primary rating from Vendor (brocade).
CVSS VectorVendor: brocade
Lifecycle Timeline
2DescriptionCVE.org
Improper handling of sensitive data during IPsec policy creation and modification in Brocade SANnav versions before 3.0.1a results in pre-shared keys being recorded in application logs. Individuals with read access to system log files or support bundles can view these credentials, leading to the potential exposure of keys used to secure network tunnels.
AnalysisAI
Pre-shared keys used for IPsec tunnel configuration are recorded in cleartext inside application log files by Brocade SANnav versions before 3.0.1a, so anyone who can read those logs or an exported support bundle can recover credentials that protect network tunnels. The exposure is triggered only when IPsec policies are actually created or modified in SANnav, and the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects a local, authenticated precondition rather than anonymous remote reach, meaning an insider or a holder of an exported bundle is the realistic actor. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that IPsec policies have actually been created or modified in SANnav (versions before 3.0.1a), which is what causes the pre-shared keys to be written to application logs. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a credential-exposure-in-logs issue (CWE-532), not a directly exploitable remote flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Brocade SANnav to 3.0.1a or later, the version in which the logging of pre-shared keys during IPsec policy creation and modification is corrected, following the instructions in the Brocade/Broadcom advisory at https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38997. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm which SANnav instances are running versions before 3.0.1a, restrict file-system and log-repository permissions on those hosts to the minimum necessary staff, suspend export of support bundles except under break-glass approval, and inventory every IPsec pre-shared key that has been created or modified through SANnav so rotation can be planned. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Incomplete log sanitization in Brocade SANnav before 3.0.1a causes extension switch IPsec pre-shared keys (PSKs) to be w
In Brocade SANnav before Brocade SANnav 2.2.0, multiple endpoints associated with Zone management are susceptible to SQL
A vulnerability in the role-based access control (RBAC) functionality of the Brocade SANNav before 2.2.0 could allow an
Brocade SANnav deployments running versions before 3.0.1a expose backend management service ports without adequate acces
Command injection in the Brocade SANnav CLI scripting component lets an authenticated user who already holds command-exe
Plaintext disclosure of administrative switch credentials and live session tokens in Brocade SANnav discovery-service lo
A vulnerability in the migration script for Brocade SANnav before 3.0 could allow the collection of database sql queries
In Brocade SANnav before Brocade SANnav v2.2.0.2 and Brocade SANnav2.1.1.8, encoded scp-server passwords are stored usin
In Brocade SANnav version before SANN2.2.0.2 and Brocade SANNav before 2.1.1.8, the implementation of TLS/SSL Server Sup
In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehas
Cleartext credential exposure in the job scheduling component of Brocade SANnav causes external server passwords and arc
A vulnerability in update-reports-purge-settings.sh script logging for Brocade SANnav before 2.4.0a could allow the coll
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today