Brocade SANnav CVE-2026-85417

Exploitation requires (1) the specific configuration conditions under which SANnav's logging subsystem fails to mask SNMP authentication and privacy passwords, and (2) an actor with read access to SANnav application logs or the generated support bundles. Per the CVSS PR:L, the attacker must already hold some privilege (log/support-bundle read); it is not remote-unauthenticated. Limiting factors: credentials only appear 'under specific configuration conditions' (non-universal), the disclosed SNMP credentials must correspond to reachable monitored switches for the downstream management access to matter, and the primary risk is realized by insiders or a post-compromise actor rather than an external attacker.

This is a genuine but bounded issue best characterized as a credential-hygiene/information-disclosure flaw rather than a directly remotely exploitable one. The vendor CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) with high subsequent-system impact (SC:H/SI:H/SA:H) yields only 6.4 (Medium), driven mostly by the CHAINED compromise of monitored switches rather than direct impact on SANnav itself. Note a discrepancy worth verifying with the vendor: the description implies exploitation requires read access to system logs or support bundles - which is inherently a local/file-read prerequisite - yet the vendor scored AV:A (adjacent network); AV:L is more consistent with the described access model. There is no EPSS score, no CISA KEV listing, and no public exploit code identified at time of analysis, so this is not evidence of widespread or automatable exploitation; realistic risk is that of an insider or a post-compromise attacker with log/bundle access harvesting SNMP credentials. This should be treated as a medium-priority patch/config-review item, not an emergency - the high subsequent-system numbers reflect what stolen SNMP credentials could enable downstream, not the ease of the initial disclosure.

An operator, support engineer, or low-privileged user who can read SANnav application logs or generate/access a support bundle opens the logs and finds SNMP v3 authentication and privacy passwords recorded in cleartext due to incomplete masking under certain configurations. They reuse those credentials to gain read or management access to the fabric switches SANnav monitors. No public exploit code exists; the 'exploit' is simply reading a log file.