Brocade ASCG EUVD-2026-94788

Requires network reachability to the Brocade ASCG data-collector service's unauthenticated API endpoint; per the CVSS 4.0 AV:A metric this is adjacent-network (same logical/physical segment or management network) rather than arbitrary Internet access, which is the primary limiting factor. The affected version must be ASCG before 3.5.0. No authentication, no valid credentials, and no user interaction are needed (PR:N/UI:N), and no non-default configuration toggle is described - the missing authorization check applies to the data-collector API as shipped. Exploitation is further bounded by the attacker needing a route to the appliance's service port, so network segmentation of the management/collector network is the main realistic mitigation beyond patching.

This is a credible high-priority issue, not merely a high-CVSS paper risk. The vendor CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) describes a low-complexity, unauthenticated attack requiring no user interaction, and the CWE-306 (missing authentication) root cause is consistent with the description's claim that the data-collector API performs no authentication or authorization. The real-world severity is amplified by the impact: the appliance can be coerced into opening SSH connections to arbitrary hosts and running arbitrary system commands, effectively a built-in unauthenticated proxy and remote-execution pivot (VC:H/VI:H). The key limiting signal is AV:A (adjacent, not full Internet network): per CVSS 4.0 this implies the attacker must reach the service from the same logical/physical network segment rather than from anywhere on the Internet, which meaningfully narrows the exposed population to those with local network foothold or flat/unsegmented management networks. No EPSS score, CISA KEV entry, or public POC was provided in the input, so exploitation probability cannot be quantified from this data; there is no public exploit identified at time of analysis. CONFLICT TO VERIFY: the description says 'An attacker with network access to the service,' which reads as general network reach, whereas the CVSS AV:A asserts only adjacent-network access - confirm the true reachability with Broadcom/Brocade advisory SA before assuming Internet-facing exposure.

An attacker positioned on the same network segment as a Brocade ASCG appliance (pre-3.5.0) sends an unauthenticated request to the exposed data-collector API endpoint, instructing it to open an SSH session to a target host and run attacker-chosen commands. Because no authentication or authorization is enforced, the appliance executes the request and acts as an unauthenticated execution/proxy vector to pivot deeper into the environment. No public exploit was identified in the provided data, so this scenario is inferred from the CVSS vector (AV:A/AC:L/PR:N/UI:N) and the missing-authentication (CWE-306) description.