CVE-2026-94578CWE-269privilege-escalation

CVE-2026-94578

High · published October 8, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
32.4
In the wild
Unconfirmed
What it is

Brocade Fabric OS versions before 10.0.1 contain an authorization logic vulnerability in the AAA (Authentication, Authorization, and Accounting) integration framework allows remote authenticated users to gain root-equivalent chassis access controls. By returning specific, crafted Vendor-Specific Attributes (VSAs) or directory claims from an external identity provider (such as RADIUS, LDAP, TACACS+, or Federated IDP), an account can bypass administrative role restriction checks during session establishment.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
7.5 · CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00394 · 32.4th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2026-10-08T07:16Z
Affected products (1)
ProductVersionsFixed in
broadcom/fabric_operating_system< 10.0.110.0.1
References (1)
https://support.broadcom.com/external/content/SecurityAdvisories/0/39150 · [email protected]
EPSS history
Timeline
  • 09 OCT 03:32Z
    EPSS moved — → 0%
    epss
  • 08 OCT 02:28Z
    Brocade Fabric OS versions before 10.0.1 contain an authorization logic vulnerability in the AAA (Authentication, Authorization, and Accounting) integration…
    cvelistv5
  • 08 OCT 02:28Z
    Brocade Fabric OS versions before 10.0.1 contain an authorization logic vulnerability in the AAA (Authentication, Authorization, and Accounting) integration…
    cvelistv5