CVE-2026-87424: CWE-321: Use of Hard-coded Cryptographic Key in Brocade Brocade Active Support Connectivity Gateway

The vulnerability CVE-2026-87424 affects Brocade Active Support Connectivity Gateway versions before 3.5.0. It arises from the use of a hard-coded cryptographic key in the SupportLink API authentication component. This design flaw allows attackers to bypass authentication controls across deployments, undermining the security of the affected systems. The CVSS 4.0 vector indicates the attack requires adjacent network access with low complexity and no user interaction, but it results in high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability enables an attacker with adjacent network access and low privileges to bypass authentication, potentially gaining unauthorized access to the system. This could lead to compromise of sensitive data and disruption of services. The vulnerability affects the confidentiality, integrity, and availability of the system, as reflected by the high CVSS score.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix link is provided, users should monitor Brocade's advisories for updates. Until a fix is available, consider restricting network access to the SupportLink API to trusted hosts only to reduce exposure.