CVE-2026-94583CWE-362

CVE-2026-94583

Low · published October 8, 2026

CVSS v3.1
2.6
EPSS
0%
Percentile
1.3
In the wild
Unconfirmed
What it is

A race condition vulnerability exists in the request processing logic of the REST management interface on Brocade Fabric OS versions before 10.0.1. When handling concurrent incoming network management FCIP requests, a timing window exists between when a request populates the address variable and when the service constructs and returns the response context. As a result, the first request adopts the modified context, causing the service to return sensitive management details or configuration data belonging to the second context back to the original requester.

The record
Technical detail
CVSS v3.1
2.6 · LOW
Vector
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
2.1 · CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00112 · 1.3th percentile
Weakness
CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Published
2026-10-08T07:16Z
Affected products (1)
ProductVersionsFixed in
broadcom/fabric_operating_system< 10.0.110.0.1
References (1)
https://support.broadcom.com/external/content/SecurityAdvisories/0/39159 · [email protected]
EPSS history
Timeline
  • 09 OCT 03:32Z
    EPSS moved — → 0%
    epss
  • 08 OCT 03:05Z
    A race condition vulnerability exists in the request processing logic of the REST management interface on Brocade Fabric OS versions before 10.0.1
    cvelistv5
  • 08 OCT 03:05Z
    A race condition vulnerability exists in the request processing logic of the REST management interface on Brocade Fabric OS versions before 10.0.1
    cvelistv5