CVE-2026-94579

HighCVSS 8.0/10Last modified Oct 14, 2026

Description

An OS command injection vulnerability exists in the PAM (Pluggable Authentication Module) session cleanup routines during SSH session termination on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user authenticating via an external directory or AAA service whose username or profile identifier contains shell metacharacters can trigger arbitrary command execution with root privileges when their remote SSH session closes.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Oct 8, 2026
Last modified
Oct 14, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-94589.8A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. The impacted element is the function setWanCfg of the file /cgi-bin/CVE-2026-945804.5An arbitrary file and directory deletion vulnerability exists in the REST API management interface handling USB storage operations on BrocadCVE-2026-945816.8An OS command injection vulnerability exists in the REST API management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 thrCVE-2026-945827.8A memory buffer overflow vulnerability exists in the internal diagnostic and route validation routines used by the Fabric Shortest Path FirsCVE-2026-945832.6A race condition vulnerability exists in the request processing logic of the REST management interface on Brocade Fabric OS versions before CVE-2026-945842.6A race condition and thread-safety vulnerability exists in the web management daemon of Brocade Fabric OS versions before 10.0.1. When handlCVE-2026-945858.8An authentication bypass vulnerability exists in the web management interface of Brocade Fabric OS versions before 9.2.2d running on the MXGCVE-2026-945866.8A command injection vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operationCVE-2026-945874.5A buffer overflow vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operations CVE-2026-945884.4In Proxmox pmg-api, an argument injection vulnerability exists in the package changelog retrieval functionality. This is caused by improper CVE-2026-945899.8The Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) plugin for WordPress is vulnerable to Arbitrary File UpCVE-2026-94598.8A security flaw has been discovered in Edimax EW-7438RPn 1.31. This affects the function formConnectionSetting of the file /goform/formConne
CVE-2026-94579: High severity, CVSS 8.0 | Vulnix