CVE Feed

    Dashboard / CVE / CVE-2026-94575

    CVE-2026-94575

    A logic vulnerability in Brocade Fabric OS versions before 10.0.1 web management framework allows an authenticated, low-privileged user to bypass inner Role-Based Access Control (RBAC) checks under specific environmental conditions. Successful exploitation lowers the system authorization mode for the active session context, allowing access to restricted configuration settings intended exclusively for administrative roles.

    Published:Oct 8, 2026
    Last Modified:Oct 14, 2026
    EPS:Oct 8, 2026
    EPSS Score:0.00185
    CVSS Score:5.7

    Affected Products

    Vendor
    Broadcom
    Product
    Fabric Operating System
    Vendor
    Brocade
    Product
    Fabric Os

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-483 Incorrect Block Delimitation

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-94585 (CVSS 7.7) — An authentication bypass vulnerability exists in the web management interface of Brocade Fabric OS versions be…
    CVE-2026-94587 (CVSS 6.9) — A buffer overflow vulnerability exists in the WebTools administrative interface handling configuration downloa…
    CVE-2026-94579 (CVSS 5.4) — An OS command injection vulnerability exists in the PAM (Pluggable Authentication Module) session cleanup rout…
    CVE-2026-94576 (CVSS 5.9) — An authentication logic and privilege escalation vulnerability exists in the account management interface of B…
    CVE-2026-87661 (CVSS 6.8) — Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 directly accepts Apache configuration fil…
    CVE-2026-87677 (CVSS 5.4) — An OS command injection vulnerability exists in the account management subsystem of Brocade Fabric OS versions…
    CVE-2026-94586 (CVSS 8.5) — A command injection vulnerability exists in the WebTools administrative interface handling configuration downl…
    CVE-2026-94581 (CVSS 8.5) — An OS command injection vulnerability exists in the REST API management interface of Brocade Fabric OS version…
    CVE-2026-94577 (CVSS 7.3) — A privilege escalation vulnerability exists in the internal Command-Line Interface (CLI) authorization handlin…
    CVE-2026-87664 (CVSS 8.5) — A session context forgery vulnerability exists in the web management daemon of Brocade Fabric OS versions 9.2.…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High