Brocade ASCG CVE-2026-87428

Exploitation requires the attacker to already have local access to the Brocade ASCG VM with at least a low-privileged account (PR:L) and the ability to issue a request into the SANnav host network namespace - this is the exact precondition named in the description. The product must be a vulnerable ASCG instance running a version before 3.5.0 that has onboarded SANnav instances whose management credentials are stored on the host. Limiting factors: the attack vector is strictly local (AV:L), not remote/network, and requires an existing authenticated foothold on the ASCG VM, so an unauthenticated external attacker cannot exploit this directly; no user interaction (UI:N) is needed once local access is held.

The input CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N, base 8.4) is internally consistent with the description: exploitation requires LOCAL access and LOW privileges (PR:L) on the ASCG VM, not network reach, and yields high confidentiality and integrity impact through theft of stored management credentials for onboarded SANnav instances. No EPSS score, CISA KEV listing, POC, or SSVC data was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. This is a genuine but conditional priority rather than a drive-by remote flaw: the local-access prerequisite (AV:L) and required low-privilege foothold (PR:L) meaningfully constrain real-world risk, but because the leaked credentials enable lateral compromise of connected SANnav servers and managed Fibre Channel switches, a successful local attacker gains an outsized blast radius. The 'Authentication Bypass' tag is misleading - CWE-522 (Insufficiently Protected Credentials) describes credential disclosure/reuse, not an authentication bypass. Note the 4.0 vector reports SC:N/SI:N despite the description explicitly citing downstream compromise of connected systems, so defenders should treat the effective impact as broader than the subsequent-system metrics suggest.

A low-privileged local user (or an attacker who has obtained a limited foothold) on the Brocade ASCG VM issues a request into the SANnav host network namespace and reads the stored management credentials for onboarded SANnav instances. Using those recovered credentials, the attacker authenticates to connected Brocade SANnav servers or managed Fibre Channel switches and takes administrative control of the SAN fabric. No public exploit code has been identified at time of analysis.