CVE-2026-85417

MediumCVSS 6.4

Published: 25/09/2026(UTC)Updated: 29/09/2026(UTC)Translated: 25/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

8th percentile - higher than 8% of all known CVEs

Summary

Incomplete property masking in the SANnav logging subsystem permits SNMP authentication and privacy passwords to be recorded in application logs under specific configuration conditions. Individuals with read access to system logs or support bundles can retrieve these credentials.

Risk Assessment

Individuals with log access can gain unauthorized read or management access to monitored switch environments. This may lead to a breach of network infrastructure security.

Recommendation

Restrict access to system logs and support bundles to essential personnel. Apply the vendor fix when available and consider rotating SNMP passwords.

Other vulnerabilities in SANnav

CVE-2026-14442Medium
An information exposure vulnerability in the job scheduling component of SANnav allows sensitive credentials to be written to application logs in plain text. When scheduled support save jobs or related operational tasks are executed, sensitive parameters including external server passwords and archive protection keys are logged without proper masking. A local or authenticated user with access to application logs or support bundles can view these cleartext credentials, potentially leading to unauthorized access to remote backup targets or protected archives.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS