CVE-2026-94580
Received Received - Intake

File Deletion in Brocade Fabric OS via REST API

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: Brocade Communications Systems, LLC

Description
An arbitrary file and directory deletion vulnerability exists in the REST API management interface handling USB storage operations on Brocade Fabric OS versions before 10.0.1. An authenticated user possessing USB management privileges can manipulate requested target paths to delete arbitrary files or directories on the switch's local root filesystem, bypassing intended USB mount point boundaries.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-08
Last Modified
2026-10-08
Generated
2026-10-08
AI Q&A
2026-10-08
EPSS Evaluated
N/A
NVD
CVE-2026-94580
EUVD
EUVD-2026-94683

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Brocade Fabric OS 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows an authenticated user with USB management privileges to delete arbitrary files or directories on the Brocade Fabric OS switch's local root filesystem. The issue occurs because the REST API management interface handling USB storage operations does not properly validate requested target paths, allowing path manipulation to bypass intended USB mount point boundaries.

Detection Guidance

Detection requires checking for unauthorized file or directory deletions on Brocade Fabric OS switches running versions before 10.0.1. Monitor system logs for unusual USB storage operations or root filesystem modifications. No specific commands are provided in the context.

Impact Analysis

An attacker with access could delete critical system files, disrupt switch operations, or cause denial of service. This may lead to loss of configuration data, network downtime, or unauthorized access to sensitive switch functions.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized file or directory deletion on the switch's filesystem. Unauthorized deletion of files may lead to data integrity issues, which could violate GDPR's data integrity principle or HIPAA's requirements for maintaining the integrity and availability of protected health information.

Mitigation Strategies

Upgrade Brocade Fabric OS to version 10.0.1 or later to address the vulnerability. Restrict USB management privileges to authorized users only. Review and audit filesystem access logs for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94580. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart