---
id: CVE-2026-87426
title: >-
  An unauthenticated network-based attacker can query specific internal
  management endpoints on Brocade ASCG versions before 3.5.0 to enumerate the
  configuration details and state of managed Brocade Fabric OS (FOS) switches
summary: >-
  An unauthenticated network-based attacker can query specific internal
  management endpoints on Brocade ASCG versions before 3.5.0 to enumerate the
  configuration details and state of managed Brocade Fabric OS (FOS) switches.
  This results i…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-200
vendor: broadcom
product: brocade_active_support_connectivity_gateway
affected:
  - brocade_active_support_connectivity_gateway < 3.5.0
patched:
  - brocade_active_support_connectivity_gateway 3.5.0
published: '2026-10-08'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T18:50:59.147'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-87426'
references:
  - url: 'https://support.broadcom.com/external/content/SecurityAdvisories/0/38393'
    label: sirt@brocade.com
tags:
  - nvd
  - cve.org
epss: 0.00148
epssPercentile: 0.03949
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-08T15:14:36.234352Z'
scores:
  nvd: 4.3
  cna: 5.3
ingestedAt: '2026-10-08T09:24:17.685Z'
---

## Overview

An unauthenticated network-based attacker can query specific internal management endpoints on Brocade ASCG versions before 3.5.0 to enumerate the configuration details and state of managed Brocade Fabric OS (FOS) switches. This results in the unauthorized disclosure of the customer's SAN fabric management topology and switch connectivity attributes.

## Affected

- `brocade_active_support_connectivity_gateway < 3.5.0`

## Remediation

Upgrade past the affected range:

- `brocade_active_support_connectivity_gateway 3.5.0`