Medium severity · published Sep 25, 2026
CVE-2026-85417
Incomplete property masking in the SANnav logging subsystem
6.4
CVSS
0.2%
EPSS
No
On KEV
Description
Incomplete property masking in the SANnav logging subsystem permits SNMP authentication and privacy passwords to be recorded in application logs under specific configuration conditions. Individuals with read access to system logs or support bundles can retrieve these credentials, leading to unauthorized read or management access to monitored switch environments
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SA
SANnav · Brocade
before 3.1.0a · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-85417
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-85417
support.broadcom.com
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/39001
More from SANnav
8.7
CVE-2026-82368
Insecure access controls on internal service ports in Brocade SANnav versions before 3.0.1a allow local, non-administrative host users to communicate directly with backend…
8.6
CVE-2026-82370
Unauthenticated remote command injection in the Brocade SANnav orchestrator HTTP service
8.6
CVE-2026-82369
Insufficient input sanitization of shell metacharacters in Brocade SANnav before 3.0.1a
8.5
CVE-2026-82372
Improper handling of sensitive data during IPsec policy creation and modification in Brocade SANnav before 3.0.1.a
8.5
CVE-2026-82371
Plaintext exposure of sensitive authentication data in SANnav discovery service log files