CVE-2026-82371: Brocade SANnav Information Disclosure Flaw

CVE-2026-82371 Overview

CVE-2026-82371 is an information disclosure vulnerability in Brocade SANnav, a storage area network management application. The discovery service writes sensitive authentication data to log files in plaintext. An attacker with read access to log files or support bundles can harvest administrative switch credentials and active session tokens. These artifacts can be used to compromise managed Fibre Channel switches and hijack active SANnav sessions. The flaw is tracked as [CWE-532: Insertion of Sensitive Information into Log File]. Brocade SANnav versions before 3.0.1a are affected.

Critical Impact
Exposed plaintext credentials and session tokens allow lateral movement into managed SAN infrastructure and takeover of administrative sessions.

Affected Products

Brocade SANnav versions prior to 3.0.1a
Brocade SANnav discovery service component
Support bundles generated from vulnerable SANnav instances

Discovery Timeline

2026-09-24 - CVE-2026-82371 published to the National Vulnerability Database
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-82371

Vulnerability Analysis

The Brocade SANnav discovery service handles enumeration and authentication against managed Fibre Channel switches. During this process, the service writes diagnostic data to log files consumed by administrators and support engineers. The log output includes administrative switch credentials and active application session tokens in cleartext.

Any user with filesystem read permission on the log directory can retrieve these secrets. The same data is bundled into support archives, which extends the exposure to anyone who handles those archives downstream. Captured switch credentials enable reconfiguration of SAN fabrics, zoning changes, and disruption of storage services. Captured session tokens allow an attacker to impersonate authenticated SANnav users without triggering a new login event.

Root Cause

The root cause is improper handling of sensitive data during logging operations, classified as [CWE-532]. The discovery service does not redact or mask authentication material before writing it to disk. Credentials and tokens that should remain in protected memory are persisted alongside routine operational data.

Attack Vector

Exploitation requires local access with low privileges to the SANnav host or to generated support bundles. No user interaction is needed. An attacker reads the discovery service log files, parses the plaintext credentials and tokens, and reuses them against managed switches or the SANnav web interface. The exposure can also propagate when support bundles are shared through ticketing systems, shared storage, or vendor support channels.

No exploitation code is required beyond standard file reading and HTTP replay tooling. See the Broadcom Security Advisory #38996 for vendor details.

Detection Methods for CVE-2026-82371

Indicators of Compromise

Unexpected read access to SANnav discovery service log directories by non-administrative accounts
Support bundles exfiltrated or copied to locations outside of standard support workflows
Administrative logins to Fibre Channel switches originating from hosts other than the SANnav server
Reuse of SANnav session tokens from new IP addresses or user agents

Detection Strategies

Audit filesystem access to SANnav log paths and alert on reads by accounts outside the SANnav service identity
Correlate switch administrative authentication events with expected SANnav management traffic sources
Inspect historical support bundles for presence of credentials and session identifiers
Monitor SANnav authentication logs for session token reuse across disparate source addresses

Monitoring Recommendations

Enable file integrity monitoring on the SANnav log and support bundle directories
Forward SANnav and managed switch authentication events to a centralized SIEM for correlation
Track generation, transfer, and deletion of SANnav support bundles as high-value artifacts

How to Mitigate CVE-2026-82371

Immediate Actions Required

Upgrade Brocade SANnav to version 3.0.1a or later as published in Broadcom Security Advisory #38996
Rotate all administrative credentials for switches managed by any vulnerable SANnav instance
Invalidate active SANnav sessions and force reauthentication for all users
Review and purge historical log files and support bundles that may contain exposed secrets

Patch Information

Broadcom addressed the issue in Brocade SANnav 3.0.1a. Refer to the Broadcom Security Advisory #38996 for the full remediation guidance and download information.

Workarounds

Restrict filesystem access to SANnav log directories to the SANnav service account and a minimal set of administrators
Treat all SANnav support bundles as sensitive artifacts and store them in access-controlled locations
Sanitize support bundles to remove credential and token material before sharing externally
Segment the SANnav management host on a restricted administrative network

bash

# Example: restrict access to SANnav log directory on Linux
chown -R sannav:sannav /var/log/sannav
chmod -R 750 /var/log/sannav
find /var/log/sannav -type f -exec chmod 640 {} \;