CVE-2026-94584

Analyzed Analyzed - Analysis Complete

BaseFortify

Publication date: 2026-10-08

Last updated on: 2026-10-14

Assigner: Brocade Communications Systems, LLC

Description

A race condition and thread-safety vulnerability exists in the web management daemon of Brocade Fabric OS versions before 10.0.1. When handling user authentication requests across a multi-threaded execution pool, this race condition causes PAM modules to process stale or incorrect client IP addresses and switch context numbers. This leads to inaccurate audit records and potential access control bypasses where AAA evaluation or Calling-Station-ID ACL policies rely on client IP attributes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-08

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-08

EPSS Evaluated

2026-10-18

NVD

CVE-2026-94584

EUVD

EUVD-2026-94684

Affected Vendors & Products

Vendor	Product	Version / Range
broadcom	fabric_operating_system	to 10.0.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-362	The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

Executive Summary

This vulnerability is a race condition and thread-safety issue in the web management daemon of Brocade Fabric OS versions before 10.0.1. It occurs when handling user authentication requests in a multi-threaded environment, causing PAM modules to process incorrect client IP addresses and context numbers. This leads to inaccurate audit logs and potential access control bypasses, especially when policies depend on client IP attributes.

Detection Guidance

Detection requires checking Brocade Fabric OS versions before 10.0.1 for race conditions in the web management daemon. Monitor audit logs for inconsistent client IP addresses or context switches during authentication. No specific commands are provided in the context.

Impact Analysis

The vulnerability may allow unauthorized access or incorrect audit records due to stale IP data during authentication. Systems relying on client IP-based policies (like AAA or ACLs) could enforce incorrect rules, potentially granting unintended access or blocking legitimate users.

Compliance Impact

This vulnerability could lead to inaccurate audit records and potential access control bypasses due to race conditions in authentication handling. This may impact compliance with standards requiring precise audit trails, such as GDPR's accountability principle or HIPAA's audit control requirements, by compromising the integrity of access logs and authentication data.

Mitigation Strategies

Upgrade Brocade Fabric OS to version 10.0.1 or later to address the race condition and thread-safety issues in the web management daemon.

Hi! I’m here to help you understand CVE-2026-94584. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70