CVE-2026-85486

Brocade ASCG before 3.5.0 improperly processes user input by evaluating form data prior to validation. When an authenticated user submits a configuration form, the submitted text could immediately be processed. A malicious actor with basic access can supply crafted input to execute arbitrary code on the server and take control of the application.

• CWE-95

• https://support.broadcom.com/external/content/SecurityAdvisories/0/38381Vendor Advisory

Published

Oct 8, 2026

Last Modified

Oct 14, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-85478A CM2507 IP camera running firmware version HMT.CM2507 v2512…3.5
• CVE-2026-85479The STTP-based data publisher on openPDC accepts network con…5.3
• CVE-2026-8548Out of bounds write in Media in Google Chrome prior to 148.0…8.3
• CVE-2026-85483Use of uninitialized resource, Return of wrong status code v…6.3
• CVE-2026-85484HTML::FormHandler versions before 0.410002 for Perl render o…6.1
• CVE-2026-85485HTML::FormHandler versions before 0.410002 for Perl render s…6.1
• CVE-2026-85487A path traversal vulnerability exists in the HTTP service co…8.8
• CVE-2026-85488Brocade ASCG before 3.5.0 has a well-known Brocade default p…7.8
• CVE-2026-85489An authentication flaw exists in the Brocade ASCG administra…8.8
• CVE-2026-8549Use after free in Media in Google Chrome prior to 148.0.7778…8.8
• CVE-2026-85490When Brocade ASCG before 3.5.0 processes support bundle arch…8.8
• CVE-2026-85491Catalyst::Seal versions before 0.03 for Perl allow one reque…8.8