CVE-2026-85487

Executive Summary

CVE-2026-85487 is a path traversal vulnerability (CWE-22) in the HTTP service component of Brocade ASCG versions prior to 3.5.0. An unauthenticated attacker with local network adjacency can send a manipulated API request to the service endpoint that bypasses path restrictions, enabling arbitrary file read, file write, or file deletion on the affected system. The flaw requires no user interaction and no authentication, and it exposes confidentiality, integrity, and availability impact simultaneously because the same primitive supports read, write, and delete operations.

Technical Analysis

CVE-2026-85487 resides in the HTTP service component of Brocade ASCG (Advanced Secure Content Gateway / ASCG appliance family per the vendor naming used in the NVD description). The root cause is a path traversal (CWE-22) weakness: input supplied to an API request is not adequately canonicalized or constrained before it is mapped onto a filesystem path, allowing the attacker to escape the intended directory boundary using traversal sequences. Because the NVD description explicitly states the endpoint is reachable "unauthenticated," the vulnerable execution path is reachable before any credential check — meaning the traversal routine is exposed on the pre-auth surface rather than behind session or token validation.

The attack surface is the HTTP service listener on the ASCG host. The description characterizes the trigger as a "manipulated API request" to "the service endpoint," which indicates a REST/HTTP API handler that accepts a client-supplied path value and resolves it server-side. No specific route, parameter name, or internal function identifier is disclosed in the NVD data provided; accordingly, this report does not invent them. What is technically determinable is:

• The trust boundary that fails is the path-to-filesystem translation performed by the HTTP service component.
• The pre-condition for exploitation is network reachability to the HTTP service (AV:A — adjacent/local network per the derived vector), not credentials.
• The consequence set is tri-partite: arbitrary file read (disclosure of configuration, secrets, config stores, or system files), arbitrary file write (potentially enabling further compromise via dropped or modified content), and arbitrary file deletion (destructive availability impact).

Impact severity is elevated because a single traversal primitive exposes I, C, and A simultaneously, and because no authentication gate stands in front of it. CVSS vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects: attack from the adjacent network, low complexity, no privileges, no user interaction, unchanged scope, and High impact across Confidentiality, Integrity, and Availability. NVD does not publish a numeric score for this record (score: N/A), so no vendor-assigned base score is asserted here.

EPSS is 0.00205 (9.6th percentile), indicating the community-assessed probability of exploitation in the wild is currently low. No public proof-of-concept, Nuclei template, or exploit code is tracked. CISA KEV does not list this CVE.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class (path traversal in an unauthenticated HTTP API) and the explicit wording of the NVD description. No specific endpoints, parameters, or function names are asserted because none are disclosed.

1. Reconnaissance / target identification. The attacker must already be positioned on the same local network segment as the ASCG HTTP service (AV:A). Target identification consists of locating hosts exposing the ASCG HTTP service — typically via internal port scanning or banner/certificate fingerprinting of the service. No pre-auth credential discovery is needed since the vulnerable path is unauthenticated.

2. Triggering the flaw class. The attacker sends a crafted HTTP API request to the ASCG service endpoint. The request carries a manipulated path value containing traversal sequences (e.g., ../ style relative segments) designed to escape the base directory the service intends to confine access to. The vulnerable handler fails to canonicalize or reject the traversal, so the resolved filesystem path escapes the intended boundary. The NVD description confirms this exact dynamic: a "manipulated API request" bypasses "path restrictions."

3. Payload / execution method (class level). The manipulation is delivered as part of the request path or an API parameter that the service uses to construct a filesystem location. Because the service does not restrict the traversal, the attacker can point the operation at files outside the intended directory. The same primitive is described as supporting three operation types — file read, file write, and file deletion — meaning the attacker selects the target file and the operation the endpoint exposes.

4. Post-exploitation impact. File read yields disclosure of sensitive files reachable by the service account (configuration, secrets, or system files). File write can enable tampering with application or system content, potentially leading to further compromise depending on what the service account is permitted to overwrite. File deletion produces destructive integrity and availability impact. All three are achievable without authentication from the adjacent network.

The core risk is amplified by the combination of (a) no authentication requirement, (b) local-network reachability only (which nonetheless includes attacker footholds inside the perimeter, VPN clients, and lateral movement after an initial breach), and (c) the read/write/delete trifecta in a single class of request.

Impact Assessment

Business impact centers on the ASCG appliance as a security/network component. Because the vulnerability is in the HTTP service component and is unauthenticated, any host on the adjacent network can reach the pre-auth attack surface. This makes the CVE a high-value lateral-movement and post-perimeter tool: an attacker who has already obtained an internal foothold (or a VPN/supplicant position) can pivot to the ASCG host and operate without credentials.

The CVSS subscores derived from the vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H indicate:

• Confidentiality: High — arbitrary file read exposes data the service account can access.
• Integrity: High — arbitrary file write permits modification of protected content.
• Availability: High — arbitrary file deletion permits destructive action against files the service depends on.
• Attack Vector: Adjacent — not remote-internet reachable; requires local network positioning.
• Privileges Required: None / User Interaction: None — no credentials, no victim action.

Blast radius is bounded by network segmentation (Adjacent vector) but is severe within that boundary. The lack of authentication in front of the vulnerable path is the single most important amplifying factor. A successful read may expose further credentials and expand the blast radius beyond the appliance; a successful write or delete can disable or corrupt the appliance's security function and, in the worst case, the broader control plane it participates in.

Detection Guidance

Sigma Rule

title: Brocade ASCG HTTP Path Traversal Attempt (CVE-2026-85487)
id: 8f3c1a2e-7b64-4e0d-9c1a-3d5f9a2b6c11
status: experimental
description: Detects HTTP requests to Brocade ASCG service endpoints containing directory traversal sequences, indicative of CVE-2026-85487 (unauthenticated path traversal allowing arbitrary file read/write/delete).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-85487
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: brocade_ascg
detection:
  selection_method:
    cs-method:
      - GET
      - POST
      - PUT
      - DELETE
  selection_traversal:
    cs-uri-query|contains:
      - '../'
      - '..%2f'
      - '..%5c'
      - '%2e%2e%2f'
      - '%2e%2e/'
      - '....//'
      - '..%252f'
  selection_uripath:
    cs-uri-stem|contains:
      - '../'
      - '%2e%2e%2f'
      - '..%5c'
  condition: selection_method and (selection_traversal or selection_uripath)
falsepositives:
  - Legitimate applications that use '..' as a literal value in query parameters
  - Security scanners performing authorized traversal testing
level: high
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026-85487
  - cwe.22

YARA Rule

rule CVE_2026_85487_Brocade_ASCG_Traversal
{
    meta:
        author = "valtersit.com"
        description = "Detects HTTP request lines containing common path traversal encodings targeting Brocade ASCG (CVE-2026-85487)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-85487"
        date = "2026-01-01"
        severity = "high"

    strings:
        $req = "HTTP/1."
        $t1  = "../"
        $t2  = "..%2f" nocase
        $t3  = "..%5c" nocase
        $t4  = "%2e%2e%2f" nocase
        $t5  = "%2e%2e/" nocase
        $t6  = "....//" nocase
        $t7  = "..%252f" nocase

    condition:
        $req and any of ($t*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-85487 Brocade ASCG HTTP Path Traversal Attempt"; flow:established,to_server; http.method; content:"GET" or content:"POST" or content:"PUT" or content:"DELETE"; http.uri; content:"../"; nocase; sid:9026085487; rev:1; reference:cve,2026-85487; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-85487; classtype:web-application-attack; metadata:created_at 2026_01_01;) 
alert http any any -> any any (msg:"CVE-2026-85487 Brocade ASCG Path Traversal Encoded (URL-encoded dot-dot)"; flow:established,to_server; http.uri; content:"%2e%2e%2f"; nocase; sid:9026085488; rev:1; reference:cve,2026-85487; classtype:web-application-attack; metadata:created_at 2026_01_01;) 
alert http any any -> any any (msg:"CVE-2026-85487 Brocade ASCG Path Traversal Backslash Encoded"; flow:established,to_server; http.uri; content:"..%5c"; nocase; sid:9026085489; rev:1; reference:cve,2026-85487; classtype:web-application-attack; metadata:created_at 2026_01_01;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where http.request.method in ("GET","POST","PUT","DELETE") and
      (http.request.uri : "*../*" or http.request.uri : "*%2e%2e%2f*" or
       http.request.uri : "*..%5c*" or http.request.uri : "*..%252f*") ]

Splunk SPL Query

index=proxy OR index=web OR index=network sourcetype=*:access* OR sourcetype=suricata
| eval uri=coalesce(uri, url, http_uri, cs_uri_stem)
| where match(uri, "(?i)(\.\./|\.\.%2f|\.\.%5c|%2e%2e%2f|%2e%2e/|\.\.\.\.//|\.\.%252f)")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as traversal_uris by src_ip, dest_ip, dest_port
| where count > 0
| eval severity="high", cve="CVE-2026-85487"
| table first_seen, last_seen, src_ip, dest_ip, dest_port, count, traversal_uris, severity, cve
| sort - count

Wazuh OSSEC Rule

<group name="brocade_ascg,cve_2026_85487,web,">
  <rule id="100487" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <match>../</match>
    <description>CVE-2026-85487: Brocade ASCG HTTP path traversal attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>web,attack,pci_dss_6.5.8,</group>
  </rule>

  <rule id="100488" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <regex>%2e%2e%2f|%2e%2e/|\.\.%5c|\.\.%252f</regex>
    <description>CVE-2026-85487: Brocade ASCG encoded path traversal attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>web,attack,pci_dss_6.5.8,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence is available from any tracked source, no vendor fix reference is published, no CISA KEV entry exists, no public exploit or PoC is tracked, and EPSS remains low (0.00205). The only authoritative version constraint comes from the NVD description itself: versions before 3.5.0 are vulnerable. Treat 3.5.0-or-later as the remediation target pending vendor confirmation of a fixed build.

1) Immediate mitigations (compensating controls until a patch is confirmed):

• Restrict network access to the ASCG HTTP service so that only explicitly trusted management hosts can reach it. Apply host-based or network ACLs and segment the management interface away from general user/endpoint VLANs (the Adjacent attack vector means internal footholds are the primary threat).
• Where the management plane permits it, disable or restrict the HTTP API service component if it is not operationally required, and expose management only over a hardened out-of-band path.
• Enforce egress/ingress filtering between management segments to prevent lateral reach from compromised endpoints and VPN clients.
• Deploy the detection rules above at the network boundary to flag traversal attempts; treat any hit as a possible exploitation attempt and triage immediately.
• Baseline the ASCG filesystem/content state (checksums of configuration and critical files) to detect unauthorized modification or deletion, since the same flaw supports write and delete.

2) Patch / upgrade steps:

• Plan an upgrade to Brocade ASCG 3.5.0 or later. Because patch confidence is 0/4 and no vendor fix reference is currently published, verify directly with Brocade support/portal that 3.5.0 contains the fix for this CVE before scheduling the change window.
• After upgrade, re-test the HTTP service with a controlled path traversal probe to confirm the path restriction is enforced.
• If an upgrade cannot be performed immediately, keep the compensating controls above in force and record a risk acceptance with a target remediation date.

3) Long-term hardening:

• Adopt a patch-and-vulnerability-management cadence that includes network/security appliances, which are frequently treated as "set and forget" and therefore accumulate unpatched pre-auth flaws like this one.
• Enforce strict input validation and path canonicalization in any internally developed or vendor-integrated API that maps client input to filesystem paths — reject traversal sequences after decoding, canonicalize, and verify the resolved path stays within the intended base directory.
• Apply defense-in-depth: run the HTTP service under a least-privilege account with a read-only or restricted filesystem view so that even a traversal primitive cannot reach sensitive system files.
• Maintain continuous monitoring for traversal indicators and alert on any unauthenticated hit to the service endpoint.

References

• NVD — CVE-2026-85487: https://nvd.nist.gov/vuln/detail/CVE-2026-85487
• CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): https://cwe.mitre.org/data/definitions/22.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Brocade ASCG product/security advisory portal (verify vendor advisory and fixed 3.5.0 release): https://www.broadcom.com/support/fibre-channel-networking (Brocade support/bulletin portal)
• FIRST EPSS — CVE-2026-85487 score and percentile: https://api.first.org/data/v1/epss?cve=CVE-2026-85487

No known threat actor campaign or exploit-in-the-wild evidence is associated with CVE-2026-85487 at the time of writing. CISA KEV does not list this CVE, and no public PoC, Nuclei template, or exploit code is tracked.