Brocade ASCG CVE-2026-85490

Exploitation requires the attacker to supply or intercept a support-bundle archive that ASCG ingests from a remote endpoint - specifically, control or man-in-the-middle over archive files originating from an already-compromised ingested endpoint (this is the AT:P attack requirement). The vulnerable code path is the support-bundle archive extraction routine, which fails to sanitize path-traversal sequences in archive entries. Limiting factors: the vector is adjacent-network (AV:A), not remote Internet-facing, so the attacker needs a foothold or position on the management network; a compromised or spoofable ingesting endpoint is a precondition; and RCE depends on writing to a sensitive host path that is executed or loaded. Affected versions are Brocade ASCG before 3.5.0; no user interaction or authentication is required once the archive-delivery precondition is met.

Signals are mixed and point to a moderate, conditional risk rather than an urgent priority. The vendor-supplied CVSS 4.0 vector (AV:A/AC:L/AT:P/PR:N/UI:N, VC:H/VI:H/VA:H) scores 7.7 (High) and indicates an unauthenticated vector with high impact to confidentiality, integrity, and availability - but it is explicitly adjacent-network (AV:A), not Internet-wide (AV:N), and carries AT:P, meaning a specific attack requirement must be met. That requirement is substantial: the attacker must be able to send or intercept support-bundle archives ingested from an already-compromised remote endpoint, so the flaw is not trivially reachable against a default, isolated deployment. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided, so exploitation probability cannot be quantified from the input. There is no indication of active exploitation. Net assessment: a genuinely impactful path-traversal-to-RCE bug, but gated behind adjacency plus a precondition (control or interception of ingested archives), which places it below network-unauthenticated 'drop everything' issues. Prioritize patching on exposed or multi-tenant management networks; de-prioritize for well-segmented deployments. Note: RCE is described as a potential ('potentially leading to') outcome, not confirmed, so the I/A:H impact rating should be verified against the vendor advisory.

An attacker who has compromised an endpoint that submits support bundles to Brocade ASCG - or who can intercept that traffic on the adjacent management network - crafts a malicious archive whose entries contain path-traversal sequences (e.g. ../../). When ASCG (before 3.5.0) extracts the bundle without sanitizing the paths, attacker-controlled files are written outside the intended directory to restricted host locations, which can be leveraged for remote code execution. No public exploit identified at time of analysis.