EUVD-2026-94687
GHSA-hvhq-wqcx-2hjw
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated low-priv account on the management network gives AV:A/PR:L/AC:L; crossing the Virtual Fabric authorization boundary into other tenants is a scope change (S:C) with high confidentiality/integrity but no availability impact.
Primary rating from Vendor (brocade).
CVSS VectorVendor: brocade
Lifecycle Timeline
3DescriptionCVE.org
An authorization and input validation vulnerability exists in Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user with restricted privileges in one Virtual Fabric can exploit this issue by submitting a specially crafted request containing an arbitrary fabric identifier. This allows the user to perform unauthorized cross-fabric operations and view configuration details within tenants/Virtual Fabrics to which they have not been granted access.
AnalysisAI
An authenticated, low-privileged user in one Virtual Fabric on a Brocade Fabric OS switch can submit a request carrying an arbitrary fabric identifier that is never validated against the caller's authorization scope, allowing unauthorized cross-fabric operations and disclosure of configuration details belonging to tenants or Virtual Fabrics they were not granted access to. Affected builds are Fabric OS releases before 9.2.2d and 10.0.0 through 10.0.0a1, and exploitation requires an adjacent/management-network position (AV:A) plus valid credentials (PR:L) in an environment where multiple tenants actually share the switch; single-fabric deployments with no tenant separation offer nothing to cross into. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated account with restricted (low) privileges within at least one Virtual Fabric on a Brocade Fabric OS switch, and a multi-tenant / Virtual Fabrics deployment where separate tenants or security domains share the same switch - in a single-fabric deployment with no tenant separation there is nothing to cross into. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a legitimately high-severity authorization flaw (vendor CVSS 4.0 base 8.5) but with meaningful real-world constraints that place it below the tier of internet-facing critical bugs. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to the vendor-fixed firmware: Brocade Fabric OS 9.2.2d or later for the 9.x line, and the first 10.0.0 maintenance release after 10.0.0a1 for switches running the 10.x track, following the instructions in the vendor advisory at https://support.broadcom.com/external/content/SecurityAdvisories/0/39081. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Brocade Fabric OS switches and flag every affected build (any release before 9.2.2d, and 10.0.0 through 10.0.0a1), then tighten management-plane and adjacent-network reachability to those devices by restricting access to a hardened jump host or dedicated management VLAN with multi-factor authentication, and begin reviewing Fabric OS audit logs for anomalous or cross-fabric request patterns. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Authenticated OS command injection in the management interface and session-processing routines of Brocade Fabric OS allo
Brocade Fabric OS contains an OS command injection flaw in the REST API management interface that lets an authenticated,
OS command injection in the WebTools administrative interface of Brocade Fabric OS lets an authenticated, high-privilege
Stack-based buffer overflow in the SNMP daemon of Brocade Fabric OS (all versions before 10.0.1) lets a remote, unauthen
Command injection in the REST API management interface of Brocade Fabric OS allows an authenticated low-privileged user
Authenticated attackers with access to the adjacent management network can exploit stack-based buffer overflows in the R
Heap corruption in Brocade Fabric OS before 10.0.1 allows an authenticated administrator to crash a SAN switch's managem
Authentication bypass in Brocade Fabric OS 9.2.2d and 10.0.0 through 10.0.0a1 allows a local low-privileged process to f
Local privilege escalation in Brocade Fabric OS (versions before 9.2.2d and 10.0.0 through 10.0.0a1) allows an unprivile
Command injection in the security certificate management component of the Brocade Fabric OS administrative management AP
An arbitrary file-move flaw in the WebTools management interface of Brocade Fabric OS (all builds before 9.2.2d and 10.0
Authentication bypass in Brocade Fabric OS versions before 9.2.2d running on the MXG610 extension switch lets a network-
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today