Brocade ASCG EUVD-2026-94797

Requires adjacent-network access (CVSS AV:A) to reach the specific internal management endpoints of a Brocade ASCG instance running a version before 3.5.0 that is actively managing Brocade Fabric OS (FOS) switches; no authentication and no user interaction are needed (PR:N/UI:N). Limiting factors: the attacker must already be positioned on the same or adjacent management/storage network segment (not arbitrary Internet reach per the vendor vector), ASCG must be deployed and managing FOS switches to have topology data to leak, and the impact is limited to read-only disclosure of SAN fabric/switch connectivity attributes with no write or disruptive capability. Note the description's 'network-based' phrasing may imply broader reachability - confirm exposure with Broadcom.

This is a medium-severity (CVSS 4.0 base 5.3) information-disclosure flaw whose real-world priority is low-to-moderate, not urgent. The vendor-supplied CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) describes low-complexity, unauthenticated exploitation but confined to an ADJACENT network (AV:A), not the full Internet, and the only impact is low confidentiality (VC:L) with no integrity or availability effect (VI:N/VA:N) - consistent with CWE-200. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active or probable exploitation; exploitation status is 'no public exploit identified at time of analysis.' A notable CONFLICT exists: the description calls the attacker 'network-based' (implying remote/Internet reach, AV:N) while the vendor's own CVSS vector assigns AV:A (adjacent) - verify the actual network exposure of the ASCG management endpoints with Broadcom/Brocade before treating this as Internet-reachable. Net assessment: a genuine but contained reconnaissance/exposure issue (SAN fabric topology leakage) that aids an attacker's later targeting rather than causing direct compromise; patch in normal cycle unless the management interface is unexpectedly Internet-exposed.

An attacker who has gained a foothold on the adjacent management/storage network segment sends unauthenticated queries to specific internal management endpoints of an unpatched Brocade ASCG instance (before 3.5.0). The endpoints return configuration details and connectivity state of the managed Fabric OS switches, revealing the customer's SAN fabric topology, which the attacker uses to map high-value storage targets for a follow-on attack. No public exploit code is identified, and exploitation requires adjacent-network access per the CVSS vector, not arbitrary Internet reach.