Brocade ASCG CVE-2026-87425

Exploitation requires network reachability to the Brocade ASCG management interface (versions before 3.5.0), which per CVE design accepts a Certificate Authority certificate WITHOUT authentication - the attacker submits an unauthorized CA cert that is then added to the TLS client trust store. Realizing the actual MITM impact has a second prerequisite reflected by AT:P and AV:A: the attacker must hold an on-path/adjacent-network position between ASCG and its outbound peers (managed Fibre Channel switches and peer nodes) to intercept those TLS sessions. Limiting factors: the AV:A (Adjacent) metric means this is not exploitable from the open Internet by default - it needs same-segment or logically adjacent access - and only outbound client connections that consult the poisoned trust store are affected, so a purely network-isolated management plane substantially reduces realistic risk.

This is a genuine but moderate-priority issue rather than an urgent emergency. The CVSS 4.0 base score is 7.6 (High), driven by PR:N/UI:N (no authentication, no user interaction) and VC:H/VI:H (high confidentiality and integrity impact via MITM), but it is tempered by AV:A (adjacent network, NOT fully remote) and AT:P (a specific attack requirement - the attacker must be positioned on-path to actually intercept the outbound TLS traffic). There is a notable conflict to flag: the description says 'unauthenticated REMOTE attacker,' but the vendor-supplied CVSS vector uses AV:A (Adjacent), implying the management interface is reachable only from a local/adjacent network segment rather than the open Internet - verify reachability with Brocade/Broadcom before treating this as internet-exposed. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no evidence of active or at-scale exploitation; combined with AT:P and the two-stage nature of the attack (poison trust store AND achieve on-path position), real-world exploitation is realistically targeted and opportunistic rather than mass/wormable. Treat as a prompt-patch item for environments where the ASCG management plane is network-adjacent to untrusted hosts, but it does not warrant the same emergency response as an AV:N, KEV-listed RCE.

An attacker with access to the same network segment as a Brocade ASCG management interface (version < 3.5.0) submits a rogue Certificate Authority certificate to the unauthenticated interface, inserting it into the TLS client trust store. Having positioned themselves on-path between ASCG and a managed switch or peer node, the attacker's forged server certificate is now trusted, allowing them to transparently intercept and tamper with that outbound TLS session. No public exploit code was identified at time of analysis.