Vulnerability Details CVE-2026-85487
A path traversal vulnerability exists in the HTTP service component of Brocade ASCG versions before 3.5.0. An unauthenticated attacker on the local network could send a manipulated API request to the service endpoint bypassing path restrictions to arbitrary file read, file write, or file deletion operations.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 9.8%
CVSS Severity
CVSS v3 Score 8.8
Products affected by CVE-2026-85487
-
cpe:2.3:a:broadcom:brocade_active_support_connectivity_gateway:1.0.0
-
cpe:2.3:a:broadcom:brocade_active_support_connectivity_gateway:1.1.0
-
cpe:2.3:a:broadcom:brocade_active_support_connectivity_gateway:1.2.0
-
cpe:2.3:a:broadcom:brocade_active_support_connectivity_gateway:1.3.0
-
cpe:2.3:a:broadcom:brocade_active_support_connectivity_gateway:1.3.0a
-
cpe:2.3:a:broadcom:brocade_active_support_connectivity_gateway:2.0.0
-
cpe:2.3:a:broadcom:brocade_active_support_connectivity_gateway:2.1.0a
-
cpe:2.3:a:broadcom:brocade_active_support_connectivity_gateway:2.1.1_01
-
cpe:2.3:a:broadcom:brocade_active_support_connectivity_gateway:3.0.0
-
cpe:2.3:a:broadcom:brocade_active_support_connectivity_gateway:3.0.0a
-
cpe:2.3:a:broadcom:brocade_active_support_connectivity_gateway:3.1.0
-
cpe:2.3:a:broadcom:brocade_active_support_connectivity_gateway:3.2.0
-
cpe:2.3:a:broadcom:brocade_active_support_connectivity_gateway:3.3.0
-
cpe:2.3:a:broadcom:brocade_active_support_connectivity_gateway:3.3.0a
-
cpe:2.3:a:broadcom:brocade_active_support_connectivity_gateway:3.4.0