EUVD-2026-94684
GHSA-wfqf-hvcg-7p66
Severity by source
CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated adjacent attacker (AV:A/PR:L) must win a timing race (AC:H); only audit integrity and IP-ACL enforcement are weakened (I:L), with no confidentiality or availability impact.
Primary rating from Vendor (brocade).
CVSS VectorVendor: brocade
Lifecycle Timeline
2DescriptionCVE.org
A race condition and thread-safety vulnerability exists in the web management daemon of Brocade Fabric OS versions before 10.0.1. When handling user authentication requests across a multi-threaded execution pool, this race condition causes PAM modules to process stale or incorrect client IP addresses and switch context numbers. This leads to inaccurate audit records and potential access control bypasses where AAA evaluation or Calling-Station-ID ACL policies rely on client IP attributes.
AnalysisAI
Incorrect client-IP attribution inside the Brocade Fabric OS web management daemon lets an authenticated, adjacent-network attacker win a timing race and potentially slip past AAA evaluation or Calling-Station-ID ACL policies on switches running Fabric OS before 10.0.1. Because the PAM modules in the multi-threaded execution pool can pick up stale or mismatched client IP addresses and switch context numbers, audit records can be misattributed and IP-keyed policy decisions can be made against the wrong session. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) an authenticated low-privilege session to the Brocade Fabric OS web management daemon (PR:L), (2) adjacent-network positioning rather than arbitrary remote Internet access (AV:A), (3) a deployment that actually relies on client-IP attributes for security - specifically AAA evaluation or Calling-Station-ID ACL policies keyed on source IP; switches not using IP-based AAA/ACL gain no meaningful attack surface beyond audit-log inaccuracy, and (4) winning a non-deterministic timing race in the multi-threaded PAM execution pool (AC:H), which cannot be triggered reliably on demand. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a low-priority issue despite the attention-grabbing 'Authentication Bypass' tag. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade affected switches to Brocade Fabric OS 10.0.1, the version boundary at which the vendor fixed this race condition, and validate against the Broadcom advisory at https://support.broadcom.com/external/content/SecurityAdvisories/0/39158 before treating any device as remediated. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Authenticated OS command injection in the management interface and session-processing routines of Brocade Fabric OS allo
Brocade Fabric OS contains an OS command injection flaw in the REST API management interface that lets an authenticated,
OS command injection in the WebTools administrative interface of Brocade Fabric OS lets an authenticated, high-privilege
Stack-based buffer overflow in the SNMP daemon of Brocade Fabric OS (all versions before 10.0.1) lets a remote, unauthen
Command injection in the REST API management interface of Brocade Fabric OS allows an authenticated low-privileged user
Authenticated attackers with access to the adjacent management network can exploit stack-based buffer overflows in the R
An authenticated, low-privileged user in one Virtual Fabric on a Brocade Fabric OS switch can submit a request carrying
Heap corruption in Brocade Fabric OS before 10.0.1 allows an authenticated administrator to crash a SAN switch's managem
Authentication bypass in Brocade Fabric OS 9.2.2d and 10.0.0 through 10.0.0a1 allows a local low-privileged process to f
Local privilege escalation in Brocade Fabric OS (versions before 9.2.2d and 10.0.0 through 10.0.0a1) allows an unprivile
Command injection in the security certificate management component of the Brocade Fabric OS administrative management AP
An arbitrary file-move flaw in the WebTools management interface of Brocade Fabric OS (all builds before 9.2.2d and 10.0
Same weakness CWE-362 – Race Condition
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today