CVE-2026-94584
Received Received - Intake

Race Condition in Brocade Fabric OS Web Management Daemon

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: Brocade Communications Systems, LLC

Description
A race condition and thread-safety vulnerability exists in the web management daemon of Brocade Fabric OS versions before 10.0.1. When handling user authentication requests across a multi-threaded execution pool, this race condition causes PAM modules to process stale or incorrect client IP addresses and switch context numbers. This leads to inaccurate audit records and potential access control bypasses where AAA evaluation or Calling-Station-ID ACL policies rely on client IP attributes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-08
Last Modified
2026-10-08
Generated
2026-10-08
AI Q&A
2026-10-08
EPSS Evaluated
N/A
NVD
CVE-2026-94584
EUVD
EUVD-2026-94684

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Brocade Fabric OS 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-362 The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a race condition and thread-safety issue in the web management daemon of Brocade Fabric OS versions before 10.0.1. It occurs when handling user authentication requests in a multi-threaded environment, causing PAM modules to process incorrect client IP addresses and context numbers. This leads to inaccurate audit logs and potential access control bypasses, especially when policies depend on client IP attributes.

Impact Analysis

The vulnerability may allow unauthorized access or incorrect audit records due to stale IP data during authentication. Systems relying on client IP-based policies (like AAA or ACLs) could enforce incorrect rules, potentially granting unintended access or blocking legitimate users.

Mitigation Strategies

Upgrade Brocade Fabric OS to version 10.0.1 or later to address the race condition and thread-safety issues in the web management daemon.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94584. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart