CVE-2026-87426

Executive Summary

CVE-2026-87426 is an unauthenticated information disclosure vulnerability in Brocade ASCG (Application Services Configuration Guide) versions prior to 3.5.0. An attacker with network access can query specific internal management endpoints to enumerate configuration details and the operational state of managed Brocade Fabric OS (FOS) switches. Successful exploitation exposes the customer's SAN fabric management topology and switch connectivity attributes, providing a high-value reconnaissance primitive for subsequent lateral movement or targeted attacks against storage area network infrastructure.

Technical Analysis

The vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The NVD description states that Brocade ASCG versions before 3.5.0 expose internal management endpoints reachable by an unauthenticated network-based attacker. These endpoints return configuration details and switch state for managed Brocade Fabric OS (FOS) switches, resulting in unauthorized disclosure of SAN fabric management topology and switch connectivity attributes.

No CVSS vector has been assigned by the CNA or NVD as reflected in the data provided. The absence of a vendor advisory and any OSV package mappings means the precise code-level mechanism — whether the exposure stems from missing authentication checks on a handler, insecure default routing, or overly permissive access control — is not documented in the available intelligence. Consistent with the described vulnerability class (unauthenticated access to internal management endpoints), the failure mode is a missing or inadequate authorization barrier protecting administrative API surface. Attackers do not need credentials; a reachable network path to the affected service is sufficient.

Affected systems are Brocade ASCG deployments below version 3.5.0. Because the disclosed data concerns managed FOS switch configuration and state, the product functions as a management or orchestration layer for SAN fabrics. The attack surface is therefore the network-facing management interface, and the confidentiality impact is high while integrity and availability are not implicated.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is available for this CVE. The attack chain below is inferred at the vulnerability-class level from the NVD description; specific endpoint paths and parameter names are not disclosed and must not be assumed.

1. Reconnaissance / target identification: The attacker scans for exposed Brocade ASCG instances (pre-3.5.0) reachable over the network. Because the vulnerability is unauthenticated, no credential acquisition or phishing phase is required; network reachability alone constitutes the precondition.

2. Triggering the flaw class: The attacker issues requests to the internal management endpoints referenced in the description. Per CWE-200, the exposure is a missing authorization control on those endpoints — the service returns data without validating that the requester is authenticated or authorized. No crafted payload, memory corruption, or injection primitive is described.

3. Data retrieval: Responses disclose configuration details and the state of managed Brocade Fabric OS switches. This is an information-gathering action, not code execution or data modification.

4. Post-exploitation impact: The attacker obtains the SAN fabric management topology and switch connectivity attributes. This intelligence can be used to map the storage network, identify high-value switches and interconnects, and plan follow-on attacks against FOS management interfaces or fabric infrastructure. No integrity or availability effects are described.

Impact Assessment

The primary impact is confidentiality loss affecting SAN fabric management metadata. The CVSS vector above reflects network attack (AV:N), low complexity (AC:L), no privileges (PR:N), no user interaction (UI:N), high confidentiality impact (C:H), and no integrity or availability impact. Business risk includes exposure of storage network architecture, which adversaries can leverage for targeted follow-on operations, including fabric manipulation or management-plane compromise. Blast radius extends to any environment where a vulnerable ASCG instance is network-reachable: the data disclosed concerns all managed FOS switches, so a single exposed instance can reveal topology across the entire managed fabric. EPSS is 0.00153 (3.9th percentile), indicating low near-term exploitation likelihood based on current telemetry, and the CVE is not in CISA KEV. No threat actor campaigns or in-the-wild exploitation are documented.

Detection Guidance

Sigma Rule

title: Unauthenticated Brocade ASCG Management Endpoint Enumeration (CVE-2026-87426)
id: 8b6f2e14-3a7c-4d91-9f2a-1c5e7b0d4a66
status: experimental
description: Detects unauthenticated requests to Brocade ASCG internal management endpoints prior to 3.5.0, indicating CVE-2026-87426 information disclosure attempts.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87426
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method:
      - GET
      - POST
  selection_ua:
    cs-user-agent|contains:
      - 'curl'
      - 'python'
      - 'Go-http-client'
      - 'sqlmap'
  selection_status:
    sc-status: 200
  filter_auth:
    cs-uri-query|contains|all:
      - 'auth'
      - 'token'
  condition: selection_method and selection_status and (selection_ua) and not filter_auth
falsepositives:
  - Authorized health-check or monitoring probes
level: medium

YARA Rule

rule CVE_2026_87426_Brocade_ASCG_InfoDisclosure
{
    meta:
        description = "Detects references to unauthenticated Brocade ASCG management endpoints associated with CVE-2026-87426"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87426"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $a = "Brocade" ascii nocase wide
        $b = "ASCG" ascii nocase wide
        $c = "Fabric OS" ascii nocase wide
        $d = "FOS" ascii wide
        $e = "switchname" ascii nocase wide
        $f = "fabric" ascii nocase wide

    condition:
        uint16(0) != 0x5A4D and
        filesize < 10MB and
        (($a or $b) and ($c or $d or $e or $f))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-87426 Brocade ASCG Unauthenticated Management Endpoint Access Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"Brocade"; nocase; http.uri; content:"ASCG"; nocase; http.user_agent; content:"curl"; nocase; sid:202687426; rev:1; metadata:reference nvd.nist.gov/CVE-2026-87426, created_at 2026_01_01, updated_at 2026_01_01; classtype:attempted-recon;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where network.protocol == "http" and http.request.method in ("GET","POST") and url.path : "*" ]
  [ network where network.protocol == "http" and http.response.status_code == 200 and
      url.path : "*" and not url.path : "*auth*" and not url.path : "*token*" ]

Splunk SPL Query

index=web OR index=proxy
| search (cs_method="GET" OR cs_method="POST")
| search (cs_UserAgent="*curl*" OR cs_UserAgent="*python*" OR cs_UserAgent="*Go-http-client*")
| search cs_uri_stem="*Brocade*" OR cs_uri_stem="*ASCG*" OR cs_uri_stem="*fos*"
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, cs_uri_stem, cs_UserAgent
| where count > 5
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="web,brocade,cve_2026_87426,">
  <rule id="100426" level="10">
    <if_sid>31100</if_sid>
    <id>^200$</id>
    <url>Brocade|ASCG|fos</url>
    <description>CVE-2026-87426: Possible unauthenticated Brocade ASCG management endpoint enumeration</description>
    <group>cve_2026_87426,recon,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations: Isolate Brocade ASCG management interfaces from untrusted networks using firewall ACLs and network segmentation. Restrict access to the ASCG administration plane to authorized management hosts only. Disable or block reachability to internal management endpoints from general user VLANs and the internet. Apply authentication at a front-end proxy where possible.

2. Patch/upgrade steps: The affected range is Brocade ASCG versions before 3.5.0. Upgrade to version 3.5.0 or later once a vendor-verified fix or advisory is published. No patch reference is currently documented; confirm with the vendor before assuming a later build contains a fix.

3. Long-term hardening: Enforce authentication and authorization on all management endpoints by default. Conduct regular exposure assessments of management interfaces. Monitor for anomalous requests to internal endpoints. Maintain inventory of ASCG deployments and FOS switches to rapidly assess blast radius during future advisories.

References

• NVD — CVE-2026-87426: https://nvd.nist.gov/vuln/detail/CVE-2026-87426
• CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: https://cwe.mitre.org/data/definitions/200.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS: https://www.first.org/epss/