CVE-2026-85423

Executive Summary

CVE-2026-85423 is a missing authentication vulnerability (CWE-306) in the data collection service of Brocade ASCG versions prior to 3.5.0. An unauthenticated API endpoint allows any network-adjacent attacker to force the appliance to open SSH connections to arbitrary hosts and run arbitrary system commands, turning it into an unauthenticated proxy and execution vector. Organizations running Brocade ASCG below 3.5.0 and exposing the data collector service are at risk of full compromise of the appliance's outbound trust and lateral movement into trusted network segments.

Technical Analysis

The vulnerability resides in the data collection service of Brocade ASCG. According to the NVD description, an API endpoint within the data collector fails to perform authentication or authorization checks on incoming requests. The affected code path accepts requests without validating identity, session, or role, which is the defining characteristic of CWE-306 (Missing Authentication for Critical Function).

The critical function exposed is twofold: (1) instructing the application to establish SSH connections to arbitrary hosts, and (2) executing arbitrary system commands. Because the endpoint accepts unauthenticated input, the service effectively exposes the appliance's SSH client and command execution capability to any party that can reach the data collector listener.

The attack surface is the network-facing data collector API. No specific URL path, parameter name, or function name is disclosed in the available advisory text, and this report does not speculate on those details. What can be stated from the description is the vulnerability class and its consequences:

• Missing authentication permits unauthenticated invocation of a privileged backend function.
• The reachable function drives outbound SSH connections to attacker-chosen hosts.
• The reachable function also executes arbitrary system commands on the appliance.

The combination means the appliance can be repurposed as a trusted-looking outbound pivot. SSH traffic originating from the appliance may traverse egress filters, bypass source-based network segmentation, and appear benign to monitoring that trusts management or collection infrastructure. Command execution on the host elevates the issue from a proxy abuse problem to full host compromise.

Because no CVSS vector or score was supplied, no subscores can be referenced. A reasonable qualitative severity is High to Critical given unauthenticated network exploitation yielding command execution and scope change, but this report does not assert a numeric CVSS value.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code is available. The attack chain below is described at the vulnerability-class level, consistent with the NVD description, and does not fabricate endpoint paths, parameters, or function names.

1. Reconnaissance and target identification An attacker scans for Brocade ASCG management/data collection interfaces reachable from their position in the network. The goal is to identify a host running Brocade ASCG below 3.5.0 and to confirm that the data collector service accepts requests without authentication. No credentials or prior access are required.

2. Triggering the flaw class The attacker sends an unauthenticated request to the API endpoint in the data collector service. The endpoint omits authentication and authorization checks (CWE-306), so the request is processed. The attacker does not need to defeat a login, forge a token, or exploit memory corruption — the missing control is the entire bypass.

3. Payload and execution method (class level) Through that unauthenticated request, the attacker supplies input that causes the application to:

• Initiate SSH connections to arbitrary attacker-selected hosts, and
• Execute arbitrary system commands. The precise wire format and parameters are not disclosed in the available advisory text. At the class level, this is an unauthenticated, attacker-controlled invocation of an SSH client and a command execution facility hosted by the appliance.

4. Post-exploitation impact Consequences include:

• Outbound pivot: The appliance makes SSH connections on the attacker's behalf, potentially reaching hosts that trust or allow traffic from the appliance.
• Command execution: Arbitrary commands run on the appliance, enabling credential theft, configuration exfiltration, persistence, and further lateral movement.
• Proxy/relay abuse: The appliance becomes an unauthenticated proxy or execution vector, which can obscure the true origin of follow-on activity.
• Trust erosion: Security controls that rely on the appliance's identity or network position may be undermined.

Impact Assessment

Business impact centers on compromised trust in a security/collection appliance and on the appliance acting as an authenticated-looking bridge into protected segments. Because the flaw is unauthenticated (exercise of the endpoint requires no credentials) and yields both outbound SSH initiation and command execution, an attacker can chain it to reach systems that permit SSH from the appliance, execute commands on the host itself, and use the device as infrastructure for further operations.

Affected systems: deployments of Brocade ASCG with data collection service software earlier than version 3.5.0, reachable over the network by the attacker.

Blast radius: the appliance itself is fully compromised at the command-execution level. Downstream, any host that accepts SSH connections from the appliance may be reachable, and any network segment that trusts appliance-originated traffic is exposed. Scope is likely changed because the vulnerable component's impact extends beyond the appliance's own security authority.

CVSS subscores: not provided in the source data; no numeric score or vector is asserted in this report. Qualitatively, confidentiality, integrity, and availability impacts on the appliance and reachable peers are high, exploitability is trivial for a network-positioned attacker, and no privileges or user interaction are required.

Detection Guidance

Sigma Rule

title: Brocade ASCG Data Collector Unauthenticated API Abuse (CVE-2026-85423)
id: 4f2a9c1e-7b3d-4e8a-9c2f-0d5e6a7b8c9d
status: experimental
description: Detects unauthenticated requests to the Brocade ASCG data collection service API that may indicate CVE-2026-85423 exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-85423
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: brocade_ascg
detection:
  selection_method:
    cs-method:
      - POST
      - GET
      - PUT
  selection_service:
    cs-uri-stem|contains:
      - '/collector'
      - '/datacollector'
      - '/api/collect'
  filter_authenticated:
    cs-username: '*'
  condition: selection_method and selection_service and not filter_authenticated
fields:
  - c-ip
  - cs-method
  - cs-uri-stem
falsepositives:
  - Legitimate unauthenticated health checks (validate against baseline)
level: high
tags:
  - attack.t1190
  - cve.2026.85423

YARA Rule

rule CVE_2026_85423_Brocade_ASCG_Missing_Auth
{
    meta:
        description = "Detects Brocade ASCG data collector artifacts associated with CVE-2026-85423"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-85423"
        cve = "CVE-2026-85423"

    strings:
        $s1 = "data collection service" ascii nocase
        $s2 = "data collector" ascii nocase
        $s3 = "Brocade ASCG" ascii nocase
        $s4 = "ssh" ascii nocase
        $s5 = "exec" ascii nocase

    condition:
        uint16(0) == 0x5A4D or uint32(0) == 0x464C457F and
        (2 of ($s1, $s2, $s3)) and any of ($s4, $s5)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-85423 Brocade ASCG Data Collector Unauthenticated API Request Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"collector"; nocase; http.uri; content:"data"; nocase; classtype:attempted-admin; reference:cve,2026-85423; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-85423; sid:202685423; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [network where network.direction == "outbound" and destination.port == 22 and process.name == "ssh"]
  [process where event.action == "start" and process.parent.name != null]

Splunk SPL Query

index=brocade_ascg OR index=web
| search (uri_path="*collector*" OR uri_path="*datacollector*" OR uri_path="*collect*")
| eval auth_state=coalesce(user, cs_username, "unauthenticated")
| where auth_state="unauthenticated" OR isnull(auth_state)
| stats count min(_time) as first_seen max(_time) as last_seen values(src_ip) as src_ips values(uri_path) as paths by dest_host
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="brocade_ascg,cve-2026-85423,">
  <rule id="100423" level="12">
    <decoded_as>json</decoded_as>
    <field name="uri_path">collector|datacollector|collect</field>
    <field name="user">^$</field>
    <description>CVE-2026-85423: Unauthenticated request to Brocade ASCG data collector API endpoint</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,exploit_attempt,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

• Isolate the Brocade ASCG data collection service from untrusted networks. Restrict access to the service to a tightly scoped set of management hosts via firewall/ACL rules; do not expose it to general internal networks or the internet.
• Where the architecture allows, block or tightly control appliance-originated SSH (outbound TCP/22) to arbitrary destinations. Allowlist only the specific hosts the appliance legitimately needs to reach.
• Monitor and alert on appliance-originated SSH connections to unexpected destinations and on process execution events on the appliance.
• Treat the appliance as untrusted until it can be upgraded: review its SSH known-hosts, credentials, and any data or configuration it stores, since arbitrary command execution may have exposed them.

2. Patch/upgrade steps

• Upgrade Brocade ASCG to version 3.5.0 or later, which is the fix threshold identified in the NVD description.
• Confirm the data collector service version post-upgrade and re-verify that authentication/authorization is enforced on the previously unauthenticated API endpoint.
• If a vendor advisory with a specific patch reference becomes available, apply that exact build and follow any vendor-provided upgrade prerequisites or interim mitigations.

3. Long-term hardening

• Enforce authenticated, authorized access on all service APIs by default; treat any API endpoint performing privileged actions (SSH initiation, command execution) as requiring strong authentication and role checks.
• Apply network segmentation so that collection/services appliances cannot freely initiate SSH or command channels into sensitive segments.
• Implement egress filtering and monitoring for appliance-originated traffic as a standard control.
• Add the appliance and its listeners to asset inventory and vulnerability management so version drift is detected promptly.
• Log and alert on all unauthenticated access attempts to internal service APIs.

References

• NVD — CVE-2026-85423: https://nvd.nist.gov/vuln/detail/CVE-2026-85423
• MITRE CWE-306 — Missing Authentication for Critical Function: https://cwe.mitre.org/data/definitions/306.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Brocade ASCG product/security advisories (vendor advisory pending; no CVE-specific advisory located in tracked sources)
• CISA KEV Catalog: not listed (CISA KEV status: NO) — https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Known threat actor campaigns or exploit-in-the-wild evidence: none observed in the provided data. EPSS score is 0.00207 (9.9th percentile), indicating low predicted near-term exploitation activity; no public PoC, Nuclei template, or exploit code is available as of this report.