CVE-2026-87428: CWE-522: Insufficiently Protected Credentials / CWE-312: Cleartext Storage of Sensitive Information in Brocade Brocade Active Support Connectivity Gateway

This vulnerability (CVE-2026-87428) in Brocade ASCG prior to version 3.5.0 involves insufficiently protected credentials (CWE-522) and cleartext storage of sensitive information (CWE-312). A local unauthorized user on the ASCG VM who can send requests to the SANnav host network namespace can extract stored management credentials for onboarded SANnav instances. This exposure enables potential compromise of connected Brocade SANnav servers or managed Brocade Fibre Channel switches. The CVSS 4.0 score is 8.4 (high severity), reflecting local attack vector with low complexity and no user interaction required, but high impact on confidentiality and integrity.

An attacker with local access to the ASCG VM can retrieve management credentials stored in cleartext, allowing them to compromise connected SANnav servers and Brocade Fibre Channel switches. This can lead to unauthorized management and control of critical storage network infrastructure.

A fixed version 3.5.0 or later of Brocade ASCG should be applied to remediate this vulnerability. Since the affected versions are prior to 3.5.0, upgrading to 3.5.0 or newer is recommended. No vendor advisory patch links were provided, so verify with the vendor for official patches or updates. Until patched, restrict local access to the ASCG VM and SANnav host network namespace to trusted users only.