VYPR
Published Oct 8, 2026· Updated Oct 12, 2026· 1 source

Brocade: 25 Coordinated Vulnerabilities in ASCG, Fabric OS, and SANnav Disclosed Together

Key findings • 25 Brocade vulnerabilities disclosed on October 8, 2026, impacting ASCG, Fabric OS, and SANnav products. • High-severity flaws include command injection, authentication bypass,…

Key findings

  • 25 Brocade vulnerabilities disclosed on October 8, 2026, impacting ASCG, Fabric OS, and SANnav products.
  • High-severity flaws include command injection, authentication bypass, and privilege escalation across multiple components.
  • Affected versions include Brocade ASCG prior to 3.5.0, Fabric OS prior to 9.2.2d/10.0.0a1/10.0.1, and SANnav prior to 3.0.1/3.0.0a.
  • Patches are available in Fabric OS 9.2.2d, 10.0.0a1, and 10.0.1; ASCG 3.5.0 and later; and SANnav 3.0.1 and later.
  • Urgent upgrades are recommended to prevent unauthorized access, data compromise, and system control.

On October 8, 2026, a coordinated disclosure event brought to light 25 vulnerabilities affecting Brocade's networking products, primarily the Brocade Access Supply Chain Gateway (ASCG) and Fabric OS (FOS). These vulnerabilities, disclosed within a two-hour window, range in severity from medium to high, with many critical flaws allowing for command injection, authentication bypass, and privilege escalation. The sheer volume and severity of these issues underscore the need for immediate attention from network administrators managing Brocade environments.

The vulnerabilities are primarily concentrated in Brocade ASCG versions prior to 3.5.0 and Brocade Fabric OS versions prior to 9.2.2d, 10.0.0a1, and 10.0.1. Several high-severity flaws in ASCG allow for the extraction of stored management credentials (CVE-2026-87428), enumeration of fabric topology (CVE-2026-87426), modification of the TLS client trust store (CVE-2026-87425), and bypass of authentication due to hardcoded cryptographic keys (CVE-2026-87424). Additionally, path traversal vulnerabilities (CVE-2026-85490, CVE-2026-85487) and flaws in administrative services (CVE-2026-85489, CVE-2026-85423, CVE-2026-85422, CVE-2026-87664) expose systems to significant risk.

Further compounding the risk, several vulnerabilities affect Brocade Fabric OS directly. High-severity issues include command injection in the WebTools administrative interface (CVE-2026-94586) and the REST API management interface (CVE-2026-94581), allowing attackers to execute arbitrary system commands with root permissions. Authentication bypass in the web management interface (CVE-2026-94585) and privilege escalation within the CLI authorization handling (CVE-2026-94577) are also critical concerns. Other Fabric OS vulnerabilities include OS command injection during SSH session termination (CVE-2026-94579) and account management subsystems (CVE-2026-87677), as well as privilege escalation via account management interfaces (CVE-2026-94576, CVE-2026-94576).

The Brocade SANnav product line is not spared, with vulnerabilities such as the capture of plaintext admin passwords in memory swap files (CVE-2026-5769), path traversal in zone alias import (CVE-2026-5049), SQL injection in API inventories (CVE-2026-5048), and the logging of encoded passwords and tokens (CVE-2026-5047) posing risks to sensitive data and system integrity.

The coordinated disclosure, spanning a mere two hours on October 8, 2026, highlights the rapid pace at which vulnerabilities are being identified and reported. The affected versions are prior to ASCG 3.5.0, SANnav 3.0.1 and 3.0.0a, and Fabric OS 9.2.2d, 10.0.0a1, and 10.0.1.

Brocade has released patches to address these vulnerabilities. Specifically, Fabric OS versions 9.2.2d, 10.0.0a1, and 10.0.1 contain fixes. Version 10.0.1 is noted to address all disclosed issues within the Fabric OS family. For ASCG, versions prior to 3.5.0 are affected, implying that version 3.5.0 or later would contain the necessary patches. Similarly, SANnav versions prior to 3.0.1 and 3.0.0a are vulnerable, indicating that updates to 3.0.1 or later are recommended. Administrators are strongly urged to apply these updates immediately to mitigate the risk of unauthorized access, data breaches, and system compromise.

This batch of 25 vulnerabilities serves as a stark reminder of the ongoing security challenges in complex network infrastructure. The interconnected nature of ASCG, Fabric OS, and SANnav means that a compromise in one area can have cascading effects across the entire Brocade ecosystem. Proactive patching and vigilant monitoring are essential to maintaining the security and integrity of these critical network components. Users should consult Brocade's official advisories for detailed information on affected versions and remediation steps. ,cve_ids:[

Synthesized by Vypr AI