What’s Vulnerable › Vulnerabilities
CVE-2026-85417: Incomplete property masking in the SANnav logging subsystem
- Severity: medium (CVSS 6.4 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-25 · updated 2026-09-29
- Weakness: CWE-532
Description
Incomplete property masking in the SANnav logging subsystem permits SNMP authentication and privacy passwords to be recorded in application logs under specific configuration conditions. Individuals with read access to system logs or support bundles can retrieve these credentials, leading to unauthorized read or management access to monitored switch environments
Affected products
- Brocade SANnav: before 3.1.0a — fixed in 3.1.0a
How to fix
Upgrade to a fixed version: Brocade SANnav 3.1.0a. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-85417 or the next vulnerability affects your stack