CVE-2026-94576CWE-187
CVE-2026-94576
High · published October 8, 2026
What it is
An authentication logic and privilege escalation vulnerability exists in the account management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. Under specific conditions, an authenticated user can bypass authorization restrictions intended to prevent modifying another account's access privileges. Exploitation allows a lower-privileged user to assign administrative roles to a target account, leading to localized privilege escalation.
The record
Technical detail
- CVSS v3.1
- 8.0 · HIGH
- Vector
- CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS v4.0
- 5.9 · CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
- EPSS
- 0.00433 · 36.6th percentile
- Weakness
- CWE-187 · Partial String Comparison
- Published
- 2026-10-08T09:17Z
Affected products (2)
| Product | Versions | Fixed in |
|---|
| broadcom/fabric_operating_system | < 9.2.2d | 9.2.2d |
| broadcom/fabric_operating_system | ≥ 10.0.0, < 10.0.1 | 10.0.1 |
References (1)
EPSS history
Timeline
09 OCT 03:32Z
EPSS moved — → 0%
epss
08 OCT 04:34Z
An authentication logic and privilege escalation vulnerability exists in the account management interface of Brocade Fabric OS versions before 9.2.2d and…
cvelistv5
08 OCT 04:34Z
An authentication logic and privilege escalation vulnerability exists in the account management interface of Brocade Fabric OS versions before 9.2.2d and…
cvelistv5