EUVD-2026-86457
GHSA-985r-r2fq-jh5w
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local log/support-archive read access (AV:L, PR:L) yields plaintext PSK disclosure - a pure confidentiality loss (C:H); integrity/availability to tunnels is a separate downstream step, so I:N/A:N.
Primary rating from Vendor (brocade).
CVSS VectorVendor: brocade
Lifecycle Timeline
3DescriptionCVE.org
Incomplete log sanitization during bulk IPsec policy collection in Brocade SANnav versions before 3.0.1a permit extension switch pre-shared keys to be written to system logs. Individuals with read access to container logs or support archives can obtain these keys, leading to the potential compromise of encrypted network tunnels.
AnalysisAI
Incomplete log sanitization in Brocade SANnav before 3.0.1a causes extension switch IPsec pre-shared keys (PSKs) to be written in cleartext to system logs during the bulk IPsec policy collection workflow, allowing any principal with read access to container logs or exported support archives to recover those keys and potentially compromise the IPsec-protected tunnels that rely on them. The issue is local and authenticated (CVSS 3.1 AV:L/AC:L/PR:L/UI:N, confidentiality-only per independent assessment), not remotely reachable, and it is tied specifically to that diagnostic collection path rather than to arbitrary attacker input; no public exploit code has been identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires local read access (AV:L, PR:L) to Brocade SANnav container logs or exported support archives on an affected instance running a version before 3.0.1a. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but bounded issue that should not be triaged on its 8.4 vendor CVSS 4.0 score alone. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Brocade SANnav to 3.0.1a or later, which is the vendor-released fix for this issue; confirm the exact target build against the advisory at https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38998 before scheduling the change. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory Brocade SANnav instances, confirm whether any are running a version before 3.0.1a, restrict access to SANnav container logs and exported support archives to the minimum necessary administrative staff, and preserve any logs or support bundles that may contain IPsec policy collection data for investigation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In Brocade SANnav before Brocade SANnav 2.2.0, multiple endpoints associated with Zone management are susceptible to SQL
A vulnerability in the role-based access control (RBAC) functionality of the Brocade SANNav before 2.2.0 could allow an
Brocade SANnav deployments running versions before 3.0.1a expose backend management service ports without adequate acces
Command injection in the Brocade SANnav CLI scripting component lets an authenticated user who already holds command-exe
Pre-shared keys used for IPsec tunnel configuration are recorded in cleartext inside application log files by Brocade SA
Plaintext disclosure of administrative switch credentials and live session tokens in Brocade SANnav discovery-service lo
A vulnerability in the migration script for Brocade SANnav before 3.0 could allow the collection of database sql queries
In Brocade SANnav before Brocade SANnav v2.2.0.2 and Brocade SANnav2.1.1.8, encoded scp-server passwords are stored usin
In Brocade SANnav version before SANN2.2.0.2 and Brocade SANNav before 2.1.1.8, the implementation of TLS/SSL Server Sup
In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehas
Cleartext credential exposure in the job scheduling component of Brocade SANnav causes external server passwords and arc
A vulnerability in update-reports-purge-settings.sh script logging for Brocade SANnav before 2.4.0a could allow the coll
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today