High severity · published Mar 3, 2026
CVE-2026-0869
Application User custom defined accounts are not properly password protected in Brocade ASCG 3.4.0
8.8
CVSS
0.4%
EPSS
No
On KEV
Description
Authentication bypass in Brocade ASCG 3.4.0 Could allow an unauthorized user to perform ASCG operations related to Brocade Support Link(BSL) and streaming configuration. and could even disable the ASCG application or disable use of BSL data collection on Brocade switches within the fabric.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
ASCG · Brocade
3.4.0 · source: vendor
BA
Brocade Active Support Connectivity Gateway · Broadcom
3.4.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-0869
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-0869
Vendor Advisory
https://support.broadcom.com/external/content/SecurityAdvisories/0/37121
More from ASCG
7.1
CVE-2025-7397
A vulnerability in the ascgshell, of Brocade ASCG before 3.3.0 stores any command executed in the Command Line Interface (CLI) in plain text within the command history