CVE-2026-5769: CWE-313: Cleartext Storage in a File or On-Disk in Brocade Brocade SANnav

CVE-2026-5769 describes a vulnerability in Brocade SANnav prior to version 3.0.1 where the Fabric OS switch admin password may be stored in plaintext within a memory swap file on the SANnav VM host server. This exposure happens under an Out Of Memory condition on the SANnav server. The vulnerability requires an authenticated admin user with server access to exploit, potentially allowing them to obtain sensitive admin credentials from the swap file.

An attacker with authenticated admin privileges and access to the SANnav server hosting the VM could retrieve the Fabric OS switch admin password in plaintext from a memory swap file. This could lead to unauthorized access to the switch admin account if the attacker can leverage these credentials. The vulnerability does not allow remote exploitation or privilege escalation by itself and requires high-level privileges on the SANnav server.

A fix is available in Brocade SANnav version 3.0.1. Users should upgrade to version 3.0.1 or later to remediate this vulnerability. Until patched, restrict access to the SANnav server hosting the VM to trusted administrators only to reduce risk.