CVE-2026-85490 Brocade CVE debrief

Who should care

Defenders responsible for Brocade Active Support Connectivity Gateway instances, especially those ingesting support bundle archives from remote endpoints, should assess exposure and prioritize verification and potential patching or compensating controls.

Why it matters

CVE-2026-85490 is a high-severity vulnerability in Brocade Active Support Connectivity Gateway that allows unauthenticated remote attackers to write arbitrary files to restricted locations, potentially leading to remote code execution. Defenders should prioritize verifying exposure, assessing the need for compensating controls, and planning for patching or upgrading to version 3.5.0 or later. The corpus does not provide specific details on exploitation, victims, or business impact, so verification is necessary to determine the actual risk.

• Potential remote code execution requires verification
• Arbitrary file writing to restricted locations
• Path traversal vulnerability in support bundle archive processing
• Need for compensating controls until patching or upgrading

Technical summary

Brocade Active Support Connectivity Gateway (ASCG) before version 3.5.0 is vulnerable to a path traversal attack. When processing support bundle archives ingested from remote compromised endpoints, the application fails to sanitize path traversal sequences contained within archive entries prior to extraction. This allows an unauthenticated remote attacker to write arbitrary files to restricted locations on the underlying host, potentially leading to remote code execution.

Defensive priority

Defenders should prioritize verifying exposure of Brocade Active Support Connectivity Gateway instances, especially those ingesting support bundle archives from remote endpoints, and assess the need for compensating controls.

Recommended defensive actions

• Verify exposure of Brocade Active Support Connectivity Gateway instances
• Assess the need for compensating controls
• Monitor for suspicious support bundle archive activity
• Prioritize patching or upgrading to version 3.5.0 or later
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE description indicates that Brocade ASCG before 3.5.0 fails to sanitize path traversal sequences in support bundle archives, allowing unauthenticated remote attackers to write arbitrary files to restricted locations, potentially leading to remote code execution. However, the corpus does not provide specific details on exploitation, victims, or business impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.