Medium severity · published Sep 24, 2026
CVE-2026-14442
Information exposure vulnerability in the job scheduling component of SANnav before 3.0.1a
6.9
CVSS
0.2%
EPSS
No
On KEV
Description
An information exposure vulnerability in the job scheduling component of SANnav allows sensitive credentials to be written to application logs in plain text. When scheduled support save jobs or related operational tasks are executed, sensitive parameters including external server passwords and archive protection keys are logged without proper masking. A local or authenticated user with access to application logs or support bundles can view these cleartext credentials, potentially leading to unauthorized access to remote backup targets or protected archives.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 5% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SA
SANnav · Brocade
before 3.1.0a · source: vendor
Affected product
SA
SANnav
Brocade
More from SANnav
8.7
CVE-2026-82368
Insecure access controls on internal service ports in Brocade SANnav versions before 3.0.1a allow local, non-administrative host users to communicate directly with backend…
8.6
CVE-2026-82370
Unauthenticated remote command injection in the Brocade SANnav orchestrator HTTP service
8.6
CVE-2026-82369
Insufficient input sanitization of shell metacharacters in Brocade SANnav before 3.0.1a
8.5
CVE-2026-82372
Improper handling of sensitive data during IPsec policy creation and modification in Brocade SANnav before 3.0.1.a
8.5
CVE-2026-82371
Plaintext exposure of sensitive authentication data in SANnav discovery service log files