CVE-2026-94580

MediumCVSS 4.5/10Last modified Oct 14, 2026

Description

An arbitrary file and directory deletion vulnerability exists in the REST API management interface handling USB storage operations on Brocade Fabric OS versions before 10.0.1. An authenticated user possessing USB management privileges can manipulate requested target paths to delete arbitrary files or directories on the switch's local root filesystem, bypassing intended USB mount point boundaries.

Metrics

CVSS 3.1 4.5/10CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Oct 8, 2026
Last modified
Oct 14, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-945816.8An OS command injection vulnerability exists in the REST API management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 thrCVE-2026-945827.8A memory buffer overflow vulnerability exists in the internal diagnostic and route validation routines used by the Fabric Shortest Path FirsCVE-2026-945832.6A race condition vulnerability exists in the request processing logic of the REST management interface on Brocade Fabric OS versions before CVE-2026-945842.6A race condition and thread-safety vulnerability exists in the web management daemon of Brocade Fabric OS versions before 10.0.1. When handlCVE-2026-945858.8An authentication bypass vulnerability exists in the web management interface of Brocade Fabric OS versions before 9.2.2d running on the MXGCVE-2026-945866.8A command injection vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operationCVE-2026-945874.5A buffer overflow vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operations CVE-2026-945884.4In Proxmox pmg-api, an argument injection vulnerability exists in the package changelog retrieval functionality. This is caused by improper CVE-2026-945899.8The Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) plugin for WordPress is vulnerable to Arbitrary File UpCVE-2026-94598.8A security flaw has been discovered in Edimax EW-7438RPn 1.31. This affects the function formConnectionSetting of the file /goform/formConneCVE-2026-945906.5Improper Verification of Source of a Communication Channel vulnerability in CodePeople2 Sell Downloads sell-downloads allows Exploitation ofCVE-2026-945918.4Armatura One stores database and message-broker credentials in an install configuration file, encrypting them with AES-128-CBC when this pro