CVE-2026-5049 Brocade CVE debrief

Who should care

Brocade SANnav administrators and security teams should assess exposure and prioritize patching. This vulnerability affects Brocade SANnav deployments, and its exploitation could lead to unauthorized data writes. Administrators and security teams should verify affected versions of Brocade SANnav and update them to mitigate potential risks. They should also monitor for local authenticated attacker activity and review

Why it matters

CVE-2026-5049 is a medium-severity path traversal vulnerability in Brocade SANnav that requires attention from administrators and security teams for patching and verification.

• Potential unauthorized data writes
• Required verification of affected versions
• Need for timely patching and updates
• Potential impact on data integrity

Technical summary

The Zone Alias Import flow feature in Brocade SANnav before 3.0.0a is vulnerable to path traversal, allowing a local authenticated attacker to write uploaded content outside the intended directory. This vulnerability has a medium severity and requires attention from administrators and security teams. The affected product is Brocade SANnav, and the vulnerability can be mitigated by patching to version 3.0.0a or later.

Defensive priority

Medium-priority patching and verification recommended for Brocade SANnav deployments.

Recommended defensive actions

• Patch Brocade SANnav to version 3.0.0a or later
• Verify affected versions of Brocade SANnav are updated
• Monitor for local authenticated attacker activity

Evidence notes

The CVE record and source item provide details on the path traversal vulnerability in Brocade SANnav. The vendor, Brocade, is the canonical source for affected products.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.