EUVD-2026-94735
GHSA-mxfh-hfg3-4hfp
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent reachability (AV:A) and high pre-existing privilege (PR:H) are required to corrupt the config; impact is availability-only (A:H) with no confidentiality or integrity effect.
Primary rating from Vendor (brocade).
CVSS VectorVendor: brocade
Lifecycle Timeline
3DescriptionCVE.org
Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 directly accepts Apache configuration file data during service setup or re-initialization. An attacker capable of corrupting the configuration structure will prevent the web management service from starting or recovering during service bring-up, leading to a persistent Denial of Service (DoS) of the administrative web interface.
AnalysisAI
Malformed Apache configuration data accepted by Brocade Fabric OS during web management service setup or re-initialization can corrupt the stored configuration and prevent the administrative web interface from starting or recovering, producing a persistent denial of service that recurs on each service bring-up. Exploitation requires an attacker who already holds high administrative privileges on the switch and can reach it from an adjacent network segment (assessed CVSS:3.1 AV:A/AC:L/PR:H/UI:N, availability-only impact), and no public exploit code was identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to already hold HIGH administrative privileges on the Brocade Fabric OS device (PR:H) and to reach it from an adjacent network segment (AV:A), then supply malformed Apache configuration file data during web management service setup or re-initialization. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate, privilege-gated availability issue rather than a top-tier priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to the fixed Fabric OS release: the vendor advisory scopes affected code to versions before 9.2.2d and to 10.0.0 through 10.0.0a1, so install Fabric OS 9.2.2d or later on the 9.x branch and consult Broadcom advisory 39160 (https://support.broadcom.com/external/content/SecurityAdvisories/0/39160) for the exact patched 10.0.0 build that supersedes 10.0.0a1 before scheduling maintenance. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Authenticated OS command injection in the management interface and session-processing routines of Brocade Fabric OS allo
Brocade Fabric OS contains an OS command injection flaw in the REST API management interface that lets an authenticated,
OS command injection in the WebTools administrative interface of Brocade Fabric OS lets an authenticated, high-privilege
Stack-based buffer overflow in the SNMP daemon of Brocade Fabric OS (all versions before 10.0.1) lets a remote, unauthen
Command injection in the REST API management interface of Brocade Fabric OS allows an authenticated low-privileged user
Authenticated attackers with access to the adjacent management network can exploit stack-based buffer overflows in the R
An authenticated, low-privileged user in one Virtual Fabric on a Brocade Fabric OS switch can submit a request carrying
Heap corruption in Brocade Fabric OS before 10.0.1 allows an authenticated administrator to crash a SAN switch's managem
Authentication bypass in Brocade Fabric OS 9.2.2d and 10.0.0 through 10.0.0a1 allows a local low-privileged process to f
Local privilege escalation in Brocade Fabric OS (versions before 9.2.2d and 10.0.0 through 10.0.0a1) allows an unprivile
Command injection in the security certificate management component of the Brocade Fabric OS administrative management AP
An arbitrary file-move flaw in the WebTools management interface of Brocade Fabric OS (all builds before 9.2.2d and 10.0
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today