CVE-2026-87426: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in Brocade Brocade Active Support Connectivity Gateway

An unauthenticated network-based attacker can access specific internal management endpoints on Brocade ASCG versions prior to 3.5.0 to enumerate configuration details and the state of managed Brocade Fabric OS switches. This exposure results in unauthorized disclosure of sensitive SAN fabric management topology and switch connectivity attributes. The vulnerability is identified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and has a CVSS 4.0 base score of 5.3, indicating medium severity. No known exploits in the wild have been reported. The affected versions are all releases from initial up to but not including 3.5.0.

The vulnerability allows unauthorized actors to gain sensitive information about the SAN fabric management topology and switch connectivity attributes without authentication. This exposure could aid attackers in further targeted attacks or reconnaissance but does not directly allow control or disruption of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, restrict network access to the management endpoints to trusted sources only to mitigate exposure.