CVE-2026-94578 — Brocade / Fabric OS

Description (CNA)

Brocade Fabric OS versions before 10.0.1 contain an authorization logic vulnerability in the AAA (Authentication, Authorization, and Accounting) integration framework allows remote authenticated users to gain root-equivalent chassis access controls. By returning specific, crafted Vendor-Specific Attributes (VSAs) or directory claims from an external identity provider (such as RADIUS, LDAP, TACACS+, or Federated IDP), an account can bypass administrative role restriction checks during session establishment.

Affected (CNA)

Vendor / product	Versions
Brocade / Fabric OS	affected 0 before 10.0.1

CWE

CWE-269

References

https://support.broadcom.com/external/content/SecurityAdvisories/0/39150

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.