CVE-2026-94585CWE-288
CVE-2026-94585
High · published October 8, 2026
What it is
An authentication bypass vulnerability exists in the web management interface of Brocade Fabric OS versions before 9.2.2d running on the MXG610 platform. An unauthenticated, network-adjacent attacker can exploit an unauthenticated endpoint within the Single Sign-On (SSO) workflow to gain administrative access to the device management interface.
The record
Technical detail
- CVSS v3.1
- 8.8 · HIGH
- Vector
- CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v4.0
- 7.7 · CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- EPSS
- 0.00186 · 7.8th percentile
- Weakness
- CWE-288 · Authentication Bypass Using an Alternate Path or Channel
- Published
- 2026-10-08T09:17Z
Affected products (1)
| Product | Versions | Fixed in |
|---|
| broadcom/fabric_operating_system | < 9.2.2d | 9.2.2d |
References (1)
EPSS history
Timeline
09 OCT 03:32Z
EPSS moved — → 0%
epss
08 OCT 04:40Z
An authentication bypass vulnerability exists in the web management interface of Brocade Fabric OS versions before 9.2.2d running on the MXG610 platform
cvelistv5
08 OCT 04:40Z
An authentication bypass vulnerability exists in the web management interface of Brocade Fabric OS versions before 9.2.2d running on the MXG610 platform
cvelistv5