Brocade ASCG EUVD-2026-94789

Exploitation requires (1) a valid authenticated account with at least basic/low-privilege access to the ASCG application (PR:L - not anonymous), and (2) network adjacency to the appliance (CVSS AV:A, i.e. same or logically adjacent network segment, not arbitrary Internet-based remote access). The concrete trigger is submission of a configuration form whose text input is evaluated by the server BEFORE input validation occurs, so the vulnerable code path is the configuration-form submission handler in versions before 3.5.0. Limiting factors that reduce realistic risk: the attacker must already possess credentials, must be network-adjacent rather than fully remote, and no user interaction by a victim is needed (UI:N). Upgrading to ASCG 3.5.0 or later removes the pre-validation evaluation behavior.

This is a CWE-95 code injection (eval of form data before validation) in Brocade ASCG before 3.5.0, carrying a vendor CVSS 4.0 base score of 8.6 (High). The supplied vector CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H is internally consistent with the description: AV:A (adjacent, not full Internet-facing network), AC:L, PR:L (basic authenticated user) and UI:N, yielding full high impact to confidentiality, integrity and availability of the vulnerable system (RCE). No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no public exploit identified at time of analysis - exploitation probability cannot be quantified from the data supplied. The key signals pull in different directions: technical impact is severe (arbitrary code execution / full application takeover), but the preconditions meaningfully constrain real-world risk - an attacker must already hold valid low-privilege credentials AND reach the appliance over an adjacent network rather than remotely, and the product is a niche management appliance. One point to verify with the vendor: the CVSS attack vector is Adjacent (AV:A) while the description's phrase 'execute arbitrary code on the server' could be read as remotely reachable - confirm the actual network exposure of the configuration form before deprioritizing. Net: a genuinely serious authenticated RCE worth patching to 3.5.0, but absent KEV/EPSS/POC evidence this reads as a high-severity-but-not-yet-actively-exploited issue rather than an emergency, best triaged as a priority patch for exposed/multi-tenant deployments.

An attacker with a basic authenticated account on the Brocade ASCG (or who has phished/obtained such low-privilege credentials) submits a configuration form containing a crafted payload in a text field. Because the application evaluates the form data before validating it, the payload is executed server-side, granting arbitrary code execution and control of the application. The CVSS Adjacent vector (AV:A) means the attacker must be positioned on the same or a logically adjacent network segment as the appliance; no public POC is identified at time of analysis.