CVE-2026-94578

HighCVSS 8.8/10Last modified Oct 14, 2026

Description

Brocade Fabric OS versions before 10.0.1 contain an authorization logic vulnerability in the AAA (Authentication, Authorization, and Accounting) integration framework allows remote authenticated users to gain root-equivalent chassis access controls. By returning specific, crafted Vendor-Specific Attributes (VSAs) or directory claims from an external identity provider (such as RADIUS, LDAP, TACACS+, or Federated IDP), an account can bypass administrative role restriction checks during session establishment.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

No affected versions have been published.

Timeline

Published
Oct 8, 2026
Last modified
Oct 14, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-945798.0An OS command injection vulnerability exists in the PAM (Pluggable Authentication Module) session cleanup routines during SSH session terminCVE-2026-94589.8A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. The impacted element is the function setWanCfg of the file /cgi-bin/CVE-2026-945804.5An arbitrary file and directory deletion vulnerability exists in the REST API management interface handling USB storage operations on BrocadCVE-2026-945816.8An OS command injection vulnerability exists in the REST API management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 thrCVE-2026-945827.8A memory buffer overflow vulnerability exists in the internal diagnostic and route validation routines used by the Fabric Shortest Path FirsCVE-2026-945832.6A race condition vulnerability exists in the request processing logic of the REST management interface on Brocade Fabric OS versions before CVE-2026-945842.6A race condition and thread-safety vulnerability exists in the web management daemon of Brocade Fabric OS versions before 10.0.1. When handlCVE-2026-945858.8An authentication bypass vulnerability exists in the web management interface of Brocade Fabric OS versions before 9.2.2d running on the MXGCVE-2026-945866.8A command injection vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operationCVE-2026-945874.5A buffer overflow vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operations CVE-2026-945884.4In Proxmox pmg-api, an argument injection vulnerability exists in the package changelog retrieval functionality. This is caused by improper CVE-2026-945899.8The Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) plugin for WordPress is vulnerable to Arbitrary File Up
CVE-2026-94578: High severity, CVSS 8.8 | Vulnix