CVE-2026-94575

Analyzed Analyzed - Analysis Complete

BaseFortify

Publication date: 2026-10-08

Last updated on: 2026-10-14

Assigner: Brocade Communications Systems, LLC

Description

A logic vulnerability in Brocade Fabric OS versions before 10.0.1 web management framework allows an authenticated, low-privileged user to bypass inner Role-Based Access Control (RBAC) checks under specific environmental conditions. Successful exploitation lowers the system authorization mode for the active session context, allowing access to restricted configuration settings intended exclusively for administrative roles.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-08

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-08

EPSS Evaluated

2026-10-18

NVD

CVE-2026-94575

EUVD

EUVD-2026-94682

Affected Vendors & Products

Vendor	Product	Version / Range
broadcom	fabric_operating_system	to 10.0.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-483	The code does not explicitly delimit a block that is intended to contain 2 or more statements, creating a logic error.

Attack-Flow Graph

Executive Summary

This is a logic vulnerability in Brocade Fabric OS versions before 10.0.1. It allows an authenticated low-privileged user to bypass role-based access control checks under specific conditions. Exploitation lowers the authorization mode for the session, granting access to administrative configuration settings.

Detection Guidance

Detection requires checking Brocade Fabric OS versions before 10.0.1 and verifying RBAC bypass attempts by low-privileged users. Review system logs for unauthorized access to administrative configuration settings. No specific commands are provided in the context.

Impact Analysis

An attacker with low privileges could gain unauthorized access to sensitive configuration settings. This could lead to system misconfigurations, data breaches, or unauthorized changes to network infrastructure.

Compliance Impact

This vulnerability allows low-privileged users to bypass RBAC checks and access restricted administrative settings, which could lead to unauthorized data access or modifications. Such unauthorized access may violate compliance requirements under GDPR (data protection) and HIPAA (healthcare data privacy), depending on the system's use case and data stored.

Mitigation Strategies

Upgrade Brocade Fabric OS to version 10.0.1 or later to address the logic vulnerability in the web management framework.

Hi! I’m here to help you understand CVE-2026-94575. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70