A vulnerability has been identified in the data collection service of Brocade ASCG versions before 3.5.0. (CVE-2026-85423)

CVE-2026-85423 describes a security flaw in Brocade ASCG data collection service versions prior to 3.5.0. The vulnerability arises because an API endpoint does not enforce authentication or authorization on incoming requests. An attacker with network access can exploit this to instruct the service to establish SSH connections to arbitrary hosts and execute arbitrary commands, effectively gaining remote code execution capabilities without authentication.

Successful exploitation allows an unauthenticated attacker with network access to execute arbitrary system commands on the affected appliance, potentially compromising confidentiality, integrity, and availability of the system and connected resources. The appliance can be misused as an unauthenticated proxy or execution vector, posing significant security risks.

No explicit patch or remediation details are provided. Since the affected versions are prior to 3.5.0, upgrading to version 3.5.0 or later is implied as a remediation step. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.