Description
A vulnerability in the SupportLink API authentication component of Brocade ASCG versions prior to 3.5.0 allows an attacker to bypass authentication across deployments due to the use of a hard coded cryptographic key.
Published: 2026-10-08
Score: 8.6 High
EPSS: < 1% Very Low
KEV: No
Impact: Authentication Bypass
Action: Immediate Patch
AI Analysis

Impact

A hard‑coded cryptographic key in the SupportLink API authentication component of Brocade Active Support Connectivity Gateway (ASCG) enables an attacker to bypass authentication. This flaw is a classic instance of CWE‑321, which can lead to unauthorized access to the API.

Affected Systems

Brocade ASCG devices running versions earlier than 3.5.0 are affected. The vendor offers an official security update in ASCG 3.5.0 that replaces the hard‑coded key with a secure, configurable mechanism.

Risk and Exploitability

The flaw has a CVSS score of 8.6, indicating high severity. The EPSS score is not available. The vulnerability affects all deployments that have not applied the update.

Generated by OpenCVE AI on October 8, 2026 at 09:54 UTC.

Remediation

Vendor Solution

Security update provided in Brocade ASCG 3.5.0

OpenCVE Recommended Actions

  • Upgrade Brocade ASCG to version 3.5.0 or later to replace the hard‑coded cryptographic key.
  • If an immediate upgrade is not feasible, restrict network access to the SupportLink API endpoint by firewall rules or access control lists until the patch is applied.
  • Enable logging and alerting for authentication failures or unexpected API calls to detect and respond to potential exploitation attempts.

Generated by OpenCVE AI on October 8, 2026 at 09:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 14 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:broadcom:brocade_active_support_connectivity_gateway:*:*:*:*:*:*:*:*
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Fri, 09 Oct 2026 07:30:00 +0000

Type Values Removed Values Added
First Time appeared Broadcom
Broadcom brocade Active Support Connectivity Gateway
Vendors & Products Broadcom
Broadcom brocade Active Support Connectivity Gateway

Thu, 08 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 08 Oct 2026 10:15:00 +0000

Type Values Removed Values Added
Title Brocade ASCG Authentication Bypass via Hard‑coded Cryptographic Key

Thu, 08 Oct 2026 07:15:00 +0000

Type Values Removed Values Added
Description A vulnerability in the SupportLink API authentication component of Brocade ASCG versions prior to 3.5.0 allows an attacker to bypass authentication across deployments due to the use of a hard coded cryptographic key.
Weaknesses CWE-321
References
Metrics cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Broadcom Brocade Active Support Connectivity Gateway
cve-icon MITRE

Status: PUBLISHED

Assigner: brocade

Published:

Updated: 2026-10-08T17:54:50.719Z

Reserved: 2026-09-08T21:56:45.681Z

Link: CVE-2026-87424

cve-icon Vulnrichment

Updated: 2026-10-08T15:18:46.998Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-08T07:16:33.000

Modified: 2026-10-14T18:50:15.510

Link: CVE-2026-87424

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-09T07:15:09Z

Weaknesses
  • CWE-321

    Use of Hard-coded Cryptographic Key