7.6
High
CVE-2026-87425 An unauthenticated remote attacker can modify the TLS client trust store in Brocade ASCG versions before 3.5.0
Description
An unauthenticated remote attacker can modify the TLS client trust store in Brocade ASCG versions before 3.5.0. By supplying an unauthorized Certificate Authority (CA) certificate to an unauthenticated management interface, the attacker can cause the system to trust unauthorized certificates, potentially enabling Man-in-the-Middle (MITM) attacks against outbound communications with managed switches and peer nodes.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Brocade Active Support Connectivity Gateway 3.5 | earliest → < 3.5.0 | 3.5.0 |
References
- support.broadcom.com support.broadcom.com
Timeline
- Published
- Last modified
Other CVEs of Brocade Active Support Connectivity Gateway
The 13 CVEs of Brocade Active Support Connectivity Gateway →
CVE-2026-87428
In Brocade ASCG before 3.5.0, a local unauthorized user on the ASCG VM who can issue a request to the SANnav host…
8.4
High
CVE-2026-87426
An unauthenticated network-based attacker can query specific internal management endpoints on Brocade ASCG versions…
5.3
Medium
CVE-2026-87424
A vulnerability in the SupportLink API authentication component of Brocade ASCG versions prior to 3.5.0 allows an…
8.6
High
CVE-2026-85490
When Brocade ASCG before 3.5.0 processes support bundle archives ingested from remote compromised endpoints, the…
7.7
High