A vulnerability in Brocade ASCG version before 3.5.0 could allow an attacker to obtain a static cryptographic key hardcoded into the software… (CVE-2026-85422)

CVE-2026-85422 describes a vulnerability in Brocade ASCG software versions prior to 3.5.0 where a static cryptographic key is hardcoded in the binaries. An attacker with local access could extract this key, compromising the confidentiality and integrity of sensitive data and inter-node communications. This includes decrypting stored management credentials and crafting forged administrative synchronization messages, potentially leading to unauthorized administrative actions.

Successful exploitation compromises confidentiality, integrity, and availability by exposing sensitive management credentials and allowing forged administrative messages. This could lead to unauthorized access and control over the affected system's management functions.

No patch or official remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local access to the affected systems and monitor for suspicious activity related to management credentials and synchronization messages.