CVE-2026-85486: CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in Brocade Brocade Active Support Connectivity Gateway

Brocade Active Support Connectivity Gateway versions prior to 3.5.0 improperly process user input by evaluating form data before validation. This flaw allows an authenticated user with basic access to submit specially crafted input that is immediately processed, leading to arbitrary code execution on the server. The vulnerability is classified as CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code, also known as Eval Injection). The CVSS 4.0 base score is 8.6, indicating high severity with attack vector requiring adjacent network access and low attack complexity. No known exploits in the wild or vendor patch links are provided in the data.

An attacker with authenticated access can execute arbitrary code on the server hosting the Brocade Active Support Connectivity Gateway. This can lead to full compromise of the application, potentially affecting confidentiality, integrity, and availability of the system. The vulnerability does not require user interaction beyond authentication and has high impact on confidentiality, integrity, and availability.

No official patch or remediation details are provided in the available data. Since the vulnerability affects versions prior to 3.5.0, upgrading to version 3.5.0 or later is implied as a remediation step if such a version exists. Until a patch is confirmed, restrict authenticated user access to trusted personnel only and monitor for suspicious activity related to configuration form submissions. Check the vendor advisory for the latest remediation guidance.