CVE-2026-14442

Executive Summary

CVE-2026-14442 is an information exposure vulnerability in the job scheduling component of Broadcom SANnav (SAN management software), where sensitive credentials — including external server passwords and archive protection keys — are written to application logs in plain text during scheduled support save jobs and related operational tasks. Affected parties are organizations running SANnav whose users or support operators can read application logs or generated support bundles. A locally authenticated user with access to those logs can recover cleartext credentials, enabling unauthorized access to remote backup targets or protected archives and potential lateral movement into backup infrastructure.

Technical Analysis

The vulnerability class is CWE-532: Insertion of Sensitive Information into Log File. The affected component is the job scheduling subsystem, which orchestrates operational tasks such as "scheduled support save jobs." Per the description, when these jobs execute, their runtime parameters — specifically external server passwords and archive protection keys — are emitted to application logs without masking or redaction. The exposure is not a memory-safety or injection flaw; it is a failure to sanitize secrets before logging. The attack surface is therefore the local logging and diagnostics surface of SANnav: application log files on disk and diagnostic/support bundles that aggregate logs. Any actor with read access to those artifacts (local OS user on the SANnav host, authenticated SANnav operator with log/support access, or any party receiving an exported support bundle) can read cleartext secrets directly. No credential-dumping tool or code execution is required; access to the log artifact is sufficient. The exact log file paths, parameter names, and the specific scheduling routines are not enumerated in the provided NVD description, so those implementation details cannot be asserted.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the CWE-532 vulnerability class and the described behavior. 1) Reconnaissance: The attacker identifies a target environment running SANnav, e.g., via Shodan results matching the SANnav management portal title, or via internal discovery. The attacker must already possess a local account or an authenticated SANnav session with rights to view logs/support bundles. 2) Trigger: The attacker causes or waits for a scheduled support save job or related operational task to run; per the description these tasks are scheduled, so triggering may be passive — the credentials are logged automatically on the normal schedule. 3) Collection: The attacker reads the application log files or generates/obtains a support bundle and scans for cleartext "external server password" and "archive protection key" values. No exploitation payload is needed at this stage — the secret is simply present in text. 4) Post-exploitation: With recovered credentials, the attacker authenticates to the referenced remote backup targets or opens the protected archives, potentially exfiltrating backups or reaching further systems. The chain requires no memory corruption, no network exploit, and no interaction beyond the local/authenticated access already held.

Impact Assessment

Impact is confidentiality-only. Using the supplied provided score of N/A for CVSS, the derived severity is Low per CVSS v3.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N ≈ 5.5); no vendor or NVD-assigned score is available, and EPSS has not yet scored this CVE. The blast radius is bounded by what the leaked secrets unlock: any remote backup target whose password is logged and any archive protected by a logged key. Because backup infrastructure frequently has broad read access to production data, compromise of backup credentials can escalate into enterprise-wide data exposure and, if the same secrets are reused, further lateral movement. Affected systems are SANnav deployments that run scheduled support save/operational jobs and retain their logs or share support bundles. Integrity and availability are not directly affected by the flaw itself, though misuse of recovered credentials could affect them downstream.

Detection Guidance

Sigma Rule

title: SANnav Cleartext Credential Logging (CVE-2026-14442)
id: 8b3f2c11-6a4e-4c9a-9f21-cve202614442
status: experimental
description: Detects SANnav job scheduler writing cleartext external server passwords or archive protection keys to logs
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-14442
logsource:
  product: linux
  service: sanlog
detection:
  keywords:
    - 'external server password'
    - 'archive protection key'
    - 'support save'
  filter:
    - 'password=****'
    - 'REDACTED'
    - 'MASKED'
  condition: keywords and not filter
falsepositives:
  - Documentation text containing the phrases
level: high

YARA Rule

rule CVE_2026_14442_SANnav_Cleartext_Credentials
{
    meta:
        author      = "Threat Intel"
        description = "Detects SANnav logs or support bundles exposing cleartext job credentials (CVE-2026-14442)"
        reference   = "https://nvd.nist.gov/vuln/detail/CVE-2026-14442"
        date        = "2026-01-01"
    strings:
        $s1 = "external server password" nocase ascii wide
        $s2 = "archive protection key" nocase ascii wide
        $s3 = "support save" nocase ascii wide
        $s4 = /password\s*[:=]\s*["']?[^\s"']{6,}/ nocase ascii
        $s5 = /protection[_\s]?key\s*[:=]\s*["']?[A-Za-z0-9+\/=]{8,}/ nocase ascii
    condition:
        filesize < 50MB and
        (any of ($s1, $s2, $s3)) and (any of ($s4, $s5))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-14442 SANnav support bundle log download of credential-bearing logs"; flow:established,to_client; http.method; content:"GET"; http.uri; content:"support"; nocase; http.uri; content:"log"; nocase; classtype:policy-violation; sid:202614442; rev:1;)

Elastic Detection

sequence by host.name with maxspan=10m
  [ file where file.path : "*sannav*" and file.name : ("*.log", "*support*") and
    message : ("external server password", "archive protection key") ]
  [ process where event.type == "start" and process.name != null ]

Splunk SPL Query

index=sannav OR index=linux sourcetype=sannav:log OR source="*support*.log"
("external server password" OR "archive protection key" OR "support save")
NOT ("REDACTED" OR "MASKED" OR "password=****")
| stats count min(_time) as first_seen max(_time) as last_seen by host source user
| where count > 0

Wazuh OSSEC Rule

<group name="sannav,cve-2026-14442,">
  <rule id="2026144" level="12">
    <decoded_as>json</decoded_as>
    <field name="message">external server password|archive protection key</field>
    <description>CVE-2026-14442: SANnav job log contains cleartext credentials</description>
    <mitre>
      <id>T1552</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix or workaround is published in the provided data.

1. Immediate mitigations: Restrict filesystem permissions on SANnav application log directories and diagnostic/support bundles to the minimum necessary accounts; treat support bundles as sensitive and encrypt them before transfer. Rotate any credentials that are or may have been written to logs — specifically external backup server passwords and archive protection keys — and avoid secret reuse across backup and archive systems. Reduce retention and access to SANnav logs, and disable or reschedule support save jobs until a fix is available where operationally feasible.
2. Patch/upgrade steps: Monitor Broadcom SANnav security advisories for an official fix addressing CVE-2026-14442 and upgrade to the corrected release once published; no patched version is identifiable from the supplied data, so upgrade mapping cannot be provided.
3. Long-term hardening: Enforce secret management so that scheduled jobs reference secrets from a vault rather than embedding values that can be logged; require log redaction/masking controls and validation testing in job scheduling code; apply least privilege to log and support-bundle readers; and integrate detection (rules above) with continuous monitoring to catch cleartext credential emission.

References

• NVD — CVE-2026-14442: https://nvd.nist.gov/vuln/detail/CVE-2026-14442
• MITRE CWE-532: Insertion of Sensitive Information into Log File: https://cwe.mitre.org/data/definitions/532.html
• MITRE ATT&CK T1552 — Unsecured Credentials: https://attack.mitre.org/techniques/T1552/
• Broadcom SANnav product/security advisory portal: https://www.broadcom.com/support (consult for the advisory covering CVE-2026-14442)
• CISA Known Exploited Vulnerabilities Catalog (currently does NOT list CVE-2026-14442): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public PoC, exploit code, or Nuclei template is available for CVE-2026-14442, and no in-the-wild exploitation or threat-actor campaign has been reported in the provided data.