CVE-2026-85486: broadcom brocade_active_support_connectivity_gateway Eval Injection

Vulnerability summary

CVE-2026-85486 is a high (CVSS 8.6) Eval Injection vulnerability in broadcom brocade_active_support_connectivity_gateway. EPSS estimates a 0.29% chance of exploitation in the next 30 days, higher than 20.5% of scored vulnerabilities.

Timeline

1. 08-10-2026
   PublishedVulnerability first disclosed.
2. 08-10-2026
   Last modifiedVulnerability information updated.

Description

Brocade ASCG before 3.5.0 improperly processes user input by evaluating form data prior to validation. When an authenticated user submits a configuration form, the submitted text could immediately be processed. A malicious actor with basic access can supply crafted input to execute arbitrary code on the server and take control of the application.

• CWE-95Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").