CVE-2026-85422: CWE-798: Use of Hard-coded Credentials / Key in Brocade Brocade Active Support Connectivity Gateway

This vulnerability (CVE-2026-85422) affects Brocade Active Support Connectivity Gateway versions prior to 3.5.0. The software contains a hard-coded static cryptographic key used to secure sensitive data at rest and protect inter-node communication protocols. If an attacker extracts this key, they can decrypt management credentials stored by the system and craft forged administrative synchronization messages, potentially compromising the integrity and confidentiality of management operations.

An attacker with access to the software binaries can extract the hard-coded cryptographic key, enabling decryption of sensitive management credentials and the ability to forge administrative synchronization messages. This compromises the confidentiality and integrity of management data and inter-node communications, potentially allowing unauthorized administrative actions.

A fixed version 3.5.0 or later is available that addresses this vulnerability. Users should upgrade to version 3.5.0 or later to remediate the issue. No vendor advisory content was provided to indicate alternative mitigations or temporary fixes.