CVE-2026-85488: CWE-798 - Use of Hard-coded Credentials in Brocade Brocade Active Support Connectivity Gateway

Brocade ASCG before version 3.5.0 contains a hard-coded default password in a script accessible to local authenticated users with read permissions on the installation path. This vulnerability allows such users to perform privilege escalation on Open Virtual Appliance deployments where default settings are still in use. The CVSS 4.0 score is 7, indicating high severity, with attack vector local, low attack complexity, no attack type, requiring low privileges and user interaction, and high impact on confidentiality, integrity, and availability.

Local authenticated users with read access to the installation path can discover the hard-coded default password and escalate their privileges on affected systems. This compromises the confidentiality, integrity, and availability of the system. The vulnerability affects Open Virtual Appliance deployments with default configurations, potentially allowing unauthorized administrative access.

No explicit patch or remediation is provided in the available data. Since this is a vulnerability in versions prior to 3.5.0, upgrading to version 3.5.0 or later is implied as a remediation step. Users should change default credentials and avoid using default configurations to mitigate the risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.