CVE-2026-94580CWE-22path-traversal

CVE-2026-94580

Medium · published October 8, 2026

CVSS v3.1
4.5
EPSS
0%
Percentile
7.7
In the wild
Unconfirmed
What it is

An arbitrary file and directory deletion vulnerability exists in the REST API management interface handling USB storage operations on Brocade Fabric OS versions before 10.0.1. An authenticated user possessing USB management privileges can manipulate requested target paths to delete arbitrary files or directories on the switch's local root filesystem, bypassing intended USB mount point boundaries.

The record
Technical detail
CVSS v3.1
4.5 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
5.7 · CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00185 · 7.7th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-10-08T08:18Z
Affected products (1)
ProductVersionsFixed in
broadcom/fabric_operating_system< 10.0.110.0.1
References (1)
https://support.broadcom.com/external/content/SecurityAdvisories/0/39143 · [email protected]
EPSS history
Timeline
  • 09 OCT 03:32Z
    EPSS moved — → 0%
    epss
  • 08 OCT 03:11Z
    An arbitrary file and directory deletion vulnerability exists in the REST API management interface handling USB storage operations on Brocade Fabric OS…
    cvelistv5
  • 08 OCT 03:11Z
    An arbitrary file and directory deletion vulnerability exists in the REST API management interface handling USB storage operations on Brocade Fabric OS…
    cvelistv5