Brocade ASCG CVE-2026-85487

Exploitation requires network reachability to the Brocade ASCG HTTP service API endpoint from the same local/adjacent network segment (CVSS AV:A) - it is not exploitable from the public internet without first obtaining such a position. No authentication is required (PR:N) and no user interaction is needed (UI:N), and the flaw affects default configurations of ASCG versions before 3.5.0. The limiting factors are therefore the adjacent-network constraint and the version requirement (strictly before 3.5.0); upgrading to 3.5.0 removes the condition entirely.

The provided CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) is internally consistent with the description: exploitation requires only adjacent (local) network access, low attack complexity, no privileges, and no user interaction, with high confidentiality and integrity impact (VC:H/VI:H) but no availability impact (VA:N). This is a genuine priority for anyone running Brocade ASCG, but the risk is meaningfully bounded by the adjacent-network attack vector (AV:A) - it is NOT internet-wide remote exploitable; an attacker must already have a foothold on the same local/management network segment as the appliance. No EPSS score, KEV listing, or POC was provided in the input, so there is no signal of active exploitation or weaponization: this is 'no public exploit identified at time of analysis.' The signals do not conflict, but the single vendor reference (Broadcom/Brocade advisory) is the only source - there is no NVD enrichment, no independent SSVC decision, and no exploitation telemetry to corroborate or temper the vendor's CVSS, so the 8.6 severity rests entirely on the vendor's own assessment.

An attacker who has gained a position on the same local network as a Brocade ASCG appliance (before version 3.5.0) sends a crafted API request to the HTTP service endpoint containing path-traversal sequences that escape the intended directory. Because the endpoint requires no authentication, the attacker reads sensitive files (e.g., credentials or configuration), overwrites files, or deletes files on the appliance. No public exploit code was identified in the provided data, so exploitation would currently require custom tooling.