CVE-2026-85486

Executive Summary

CVE-2026-85486 is a code injection vulnerability (CWE-95) in Brocade ASCG versions prior to 3.5.0, in which the product evaluates submitted form data before validating it. An authenticated user with only basic access privileges can submit a configuration form containing crafted input that is processed immediately, resulting in arbitrary code execution on the server and full compromise of the application. The vendor has addressed the issue in ASCG 3.5.0; however, tracked patch-confidence sources currently show no corroborating evidence, and no public proof-of-concept, Nuclei template, or exploit code exists in the wild, keeping near-term exploitation risk driven primarily by motivated, credentialed attackers.

Technical Analysis

The vulnerability class here is improper input handling leading to code injection — specifically mapped by the CNA to CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code), commonly referenced as "Eval Injection."

The NVD description states that Brocade ASCG "before 3.5.0 improperly processes user input by evaluating form data prior to validation." This indicates a classic order-of-operations flaw: the application parses and executes the content of a submitted configuration form before the input has passed any validation or sanitization routine. The correct secure pattern is validate-then-process; ASCG implements process-then-validate, meaning the malicious payload reaches the evaluation sink before any guardrail can reject it.

Because validation occurs after evaluation, standard input-filtering controls that the application may still possess are rendered ineffective — by the time the filter runs, the code has already executed. The attack surface is the configuration form submission interface of the ASCG web application. The critical pre-condition is that the attacker must be authenticated with basic access; this is not a pre-auth or unauthenticated remote code execution issue. However, "basic access" implies the lowest-privileged role able to submit configuration forms, dramatically lowering the bar compared to administrative compromise.

No further code-level specifics — such as function names, class names, API endpoints, file paths, or parameter names — are provided in the NVD description or CNA title. Analysts should therefore treat the exact evaluation sink (e.g., which server-side language interpreter, template engine, or command handler processes the form) as currently unspecified. The reliable, defensible characterization is: a dynamically evaluated input path exists that fires before input validation, and that path is reachable by an authenticated low-privilege user.

The absence of a CVSS vector from the NVD and CNA sources means the score above is an analyst-derived estimate consistent with the described impact (network-reachable, low privileges required, no user interaction, high confidentiality/integrity/availability impact). It should be treated as provisional until NVD publishes an official vector.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-95 / eval injection) and the NVD description. No specific endpoints, parameter names, or payload strings are fabricated.

1) Reconnaissance / target identification. An attacker identifies an internet- or intranet-exposed Brocade ASCG instance (version < 3.5.0). The ASCG web interface — commonly associated with Brocade's application delivery and network configuration management stack — is fingerprinted via HTTP response headers, page titles, and version strings. Shodan-style queries (http.title:"Brocade", http.html:"ASCG") are used to enumerate candidate hosts. The attacker confirms the version is below 3.5.0.

2) Access acquisition. Because exploitation requires an authenticated user, the attacker must first obtain basic access — via valid credentials from a previous breach, credential stuffing, phishing, default or weak credentials, or a separately compromised low-privilege account. This is a credentialed attack; the flaw itself does not grant initial authentication.

3) Triggering the flaw. Once authenticated at the basic level, the attacker navigates to a configuration form and submits crafted input. Because ASCG evaluates the form data before validation, the payload is processed immediately upon submission rather than being rejected or sanitized first. The exact payload syntax depends on the underlying evaluation mechanism (which is not disclosed in available intelligence); the defining property is that attacker-controlled form content reaches a dynamic evaluation sink pre-validation.

4) Execution and post-exploitation. Successful injection yields arbitrary code execution on the server under the ASCG application's privileges. The attacker can then take control of the application — read/modify configuration data, pivot to adjacent managed network devices or backend services reachable from the ASCG host, establish persistence, and use the host as a foothold into the broader management plane that ASCG governs.

Key constraints: authenticated access required; no user interaction from a victim is needed; no known in-the-wild exploitation (EPSS 0.00228, 12.4th percentile; not in CISA KEV).

Impact Assessment

• Confidentiality: High. With arbitrary code execution, the attacker can read configuration data, credentials, and any secrets accessible to the application.
• Integrity: High. The attacker can alter application behavior and configuration — particularly dangerous for a tool that manages network/app-delivery infrastructure.
• Availability: High. Full application control enables denial of service, destructive changes, or persistence mechanisms.
• Attack Vector: Network — the form interface is remotely reachable.
• Privileges Required: Low — only "basic access" is needed, a markedly lower bar than admin compromise.
• User Interaction: None — the attacker acts directly.
• Scope: Unchanged under this estimate; analysts should reassess if ASCG's management role implies downstream network-device compromise (which could argue for Scope:Changed).

Blast radius: Brocade ASCG is a management/configuration platform. A compromised ASCG instance may serve as a trust anchor and pivot point for the network infrastructure it manages, making the real-world blast radius larger than a single host. Organizations running an unpatched ASCG below 3.5.0, especially where the interface is reachable from untrusted networks or shared with low-privilege users, should treat this as high priority. Note the zero patch-confidence flag: verification of the vendor fix against tracked sources is currently absent, so defenders should independently confirm remediation in their environment.

Detection Guidance

Sigma Rule

title: Brocade ASCG Pre-Validation Form Input Code Injection (CVE-2026-85486)
id: 8f2c1a4e-3b7d-4c9a-9e21-ascg85486
status: experimental
description: Detects suspicious code-like input submitted to Brocade ASCG configuration forms prior to version 3.5.0, consistent with CWE-95 eval injection.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-85486
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: brocade
detection:
  selection_method:
    http.method: 'POST'
  selection_path:
    cs-uri-stem|contains:
      - '/config'
      - '/admin'
      - '/form'
  selection_payload:
    cs-uri-query|contains:
      - 'eval('
      - 'system('
      - 'exec('
      - '${'
      - '#{'
      - '<%'
      - ';cat '
      - '|whoami'
      - '`id`'
  condition: selection_method and selection_path and selection_payload
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
  - cs-username
falsepositives:
  - Legitimate administrative configuration containing reserved characters
level: high
tags:
  - attack.t1190
  - cve.2026.85486

YARA Rule

rule CVE_2026_85486_Brocade_ASCG_EvalInjection
{
    meta:
        description = "Detects eval-injection style payloads targeting Brocade ASCG config forms (CVE-2026-85486)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-85486"
        date = "2026-01-01"
        severity = "high"

    strings:
        $eval1 = "eval(" ascii nocase
        $eval2 = "system(" ascii nocase
        $eval3 = "exec(" ascii nocase
        $eval4 = "Runtime.getRuntime" ascii nocase
        $tpl1  = "${" ascii
        $tpl2  = "#{" ascii
        $tpl3  = "<%" ascii
        $cmd1  = "whoami" ascii nocase
        $cmd2  = "/bin/sh" ascii nocase

    condition:
        uint16(0) == 0x504B or uint32(0) == 0x504B0304 or true
        and 2 of ($eval*)
        or (1 of ($eval*) and 1 of ($tpl*, $cmd*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-85486 Brocade ASCG Pre-Validation Code Injection Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/config"; http.request_body; content:"eval("; nocase; http.request_body; content:"system("; nocase; http.request_body; pcre:"/(eval|system|exec)\s*\(|\\$\\{|#\\{/i"; classtype:web-application-attack; sid:202685486; rev:1; reference:cve,2026-85486; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

sequence by source.ip with maxspan=1m
  [ network where http.request.method == "POST" and
      http.request.body.content : ("eval(" or "system(" or "exec(" or "${" or "#{") ]
  [ network where http.response.status_code == 200 ]

Splunk SPL Query

index=web sourcetype=access_combined
| eval uri=lower(uri_path), body=lower(form_data)
| where (like(uri, "%/config%") OR like(uri, "%/admin%") OR like(uri, "%/form%"))
| search (like(body, "%eval(%") OR like(body, "%system(%") OR like(body, "%exec(%") OR like(body, "%${%") OR like(body, "%#{%"))
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri, status
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,brocade,ascg,cve-2026-85486,">
  <rule id="2026854" level="12">
    <if_sid>31100</if_sid>
    <id>^POST</id>
    <match>eval\(|system\(|exec\(</match>
    <description>CVE-2026-85486: Brocade ASCG pre-validation code injection attempt detected in web request</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The fixed version is stated as ASCG 3.5.0 in the CVE description, but no vendor advisory or tracked patch source has been confirmed. Treat current patch posture as unverified until the vendor fix is independently validated.

1) Immediate mitigations

• Restrict access to the ASCG configuration interface. Place the management UI behind a VPN, bastion host, or IP allow-list. Never expose ASCG directly to untrusted networks.
• Enforce least privilege. Since exploitation needs only "basic access," audit ASCG accounts and remove standing low-privilege access where not strictly required. Enforce MFA and strong, unique credentials to block credential-stuffing paths to the required authenticated foothold.
• Segment the management plane. Isolate ASCG from the network devices it manages and from general user networks to limit pivot potential.
• Monitor for the injection patterns defined in the Detection Guidance section above to catch attempts before or during exploitation.

2) Patch / upgrade steps

• Upgrade to Brocade ASCG 3.5.0 or later. This is the version in which the pre-validation evaluation flaw is remediated per the CVE record.
• Verify the fix. Because patch-confidence is 0/4 with no corroborating sources, independently confirm the fixed behavior (validate-then-process ordering) after upgrading, and obtain the official Brocade advisory to confirm CVE coverage. Where the vendor advisory is unavailable, engage Brocade support directly.
• Rotate credentials and review configuration integrity on any instance that may have been exposed or running a vulnerable version.

3) Long-term hardening

• Adopt a validate-before-evaluate development and code-review standard to eliminate the process-before-validate anti-pattern class-wide.
• Eliminate dynamic evaluation of user-supplied input entirely wherever possible; replace dynamic eval sinks with safe, structured parsers.
• Implement centralized logging, alerting, and anomaly detection on the ASCG management interface, correlated with authentication events.
• Maintain a patch-management process with SBOM/version tracking for management-plane appliances, since these often become high-value pivots.

References

1. NVD — CVE-2026-85486: https://nvd.nist.gov/vuln/detail/CVE-2026-85486
2. CWE-95 — Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection'): https://cwe.mitre.org/data/definitions/95.html
3. Brocade / Broadcom ASCG product security advisories (vendor advisory not yet referenced in tracked sources — verify with vendor).
4. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
5. CISA Known Exploited Vulnerabilities Catalog (CVE-2026-85486 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / exploit-in-the-wild status: No public PoC, no Nuclei template, and no exploit code are known. EPSS is 0.00228 (12.4th percentile), and the CVE is not in the CISA KEV catalog — indicating no confirmed in-the-wild exploitation at the time of writing.