Brocade SANnav EUVD-2026-94755

Exploitation requires all of the following concrete prerequisites: (1) the attacker must be an authenticated admin user (PR:H) with local access to the server/host operating system running the SANnav Virtual Machine - not the SANnav application interface itself; (2) the host must experience an Out-Of-Memory (OOM) condition that causes memory to be paged to the swap file, which is the specific trigger that exposes the Fabric OS switch admin password in plaintext; and (3) the attacker must be able to read the OS memory swap file on disk. Limiting factors that reduce real-world risk: the vulnerability is local-only (not network-reachable), requires pre-existing high-privilege host access, depends on a non-deterministic OOM event occurring while the credential is in memory (reflected as AC:H and AT:P), and affects only SANnav versions before 3.0.1.

This is a genuinely low-to-moderate priority issue despite being a confidentiality flaw involving admin credentials. The CVSS 4.0 vector (AV:L/AC:H/AT:P/PR:H) signals a high barrier to exploitation: an attacker must already be an authenticated admin with local access to the server hosting the SANnav VM, must contend with high attack complexity, and faces a present attack requirement (AT:P) - namely that a specific, non-deterministic condition (an Out-Of-Memory event causing the credential to be paged into the swap file) must occur. The confidentiality impact is high (VC:H) because the captured secret is the Brocade Fabric OS switch admin password, but integrity and availability are unaffected (VI:N/VA:N) and there is no scope change. No EPSS score was provided in the input, there is no CISA KEV listing, and no public proof-of-concept was referenced, so all exploitation-probability signals are either absent or point to low real-world urgency. The practical risk is best characterized as a privilege-escalation/lateral-movement enabler for an already-privileged insider or an attacker who has already compromised the SANnav host, rather than a remotely exploitable entry point. The signals are internally consistent - there is no contradiction between the local, high-privilege vector and the description. Missing data to note: no EPSS, no KEV, and no POC status were supplied, so exploitation likelihood is inferred solely from the CVSS vector and description.

An attacker who has already obtained authenticated admin access to the server hosting the Brocade SANnav VM waits for or induces an Out-Of-Memory condition, which causes the Fabric OS switch admin password to be written in plaintext to the system memory swap file. The attacker then reads the swap file from disk and recovers the cleartext switch credential, enabling lateral movement to the managed Fibre Channel fabric switches. No public exploit was identified at time of analysis, and the high attack complexity plus required OOM condition make this an opportunistic rather than reliable attack.