CVE-2026-85490

HighCVSS 8.8/10Last modified Oct 14, 2026

Description

When Brocade ASCG before 3.5.0 processes support bundle archives ingested from remote compromised endpoints, the application fails to sanitize path traversal sequences contained within archive entries prior to extraction. An unauthenticated remote attacker capable of sending or intercepting ingested archive files can leverage this flaw to write arbitrary files to restricted locations on the underlying host, potentially leading to remote code execution.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
Brocade	Brocade Active Support Connectivity Gateway	< 3.5.0

References

https://support.broadcom.com/external/content/SecurityAdvisories/0/38389Vendor Advisory

Timeline

Published: Oct 8, 2026
Last modified: Oct 14, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-854918.8Catalyst::Seal versions before 0.03 for Perl allow one request to disable a path or route a later one past an authorization check via a disp CVE-2026-854926.1The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) plugin for WordPress is vulne CVE-2026-854938.7Uncontrolled Recursion vulnerability in Apache Thrift Dart and Java ME bindings. This issue affects Apache Thrift: before 0.25.0. User CVE-2026-854947.5Improper handling of length parameter inconsistency, Uncaught exception, Inefficient Algorithmic Complexity, Memory allocation with excessiv CVE-2026-854968.8The Botslab G980H dash camera firmware generates session identifiers using a small sequential value space rather than a suitably unpredictab CVE-2026-854979.8CareCam CM2507 IP cameras store the device's root-account password using a fixed legacy password hash that provides insufficient resistance CVE-2026-854983.5A flaw was found in polkit. When processing input that begins with a null byte, an arithmetic error in the authentication agent helper cause CVE-2026-854999.1Improper Authorization vulnerability in Apache SkyWalking BanyanDB. The Canopy includes incomplete proof-of-concept role and monitoring-p CVE-2026-85506.5Use after free in Google Lens in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to CVE-2026-855009.1Authentication Bypass by Primary Weakness vulnerability in team-alembic AshAuthentication allows an unconfirmed user to obtain a session, de CVE-2026-855017.5Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term 'ReTrap'. These result in degra CVE-2026-855049.8FreeIPMI before 1.6.19 has a stack-based buffer overflow in _ipmi_sel_oem_fujitsu_get_sel_entry_long_text in libfreeipmi/sel/ipmi-sel-string