ZeroDay Findings
Sign inSign up

Findings

CVE-2026-94578

Brocade Fabric OS versions before 10.0.1 contain an authorization logic vulnerability in the AAA (Authentication, Authorization, and Accounting) integration framework…

Published Oct 8, 2026 · updated Oct 14, 2026 · broadcom fabric operating system

Brocade Fabric OS versions before 10.0.1 contain an authorization logic vulnerability in the AAA (Authentication, Authorization, and Accounting) integration framework allows remote authenticated users to gain root-equivalent chassis access controls. By returning specific, crafted Vendor-Specific Attributes (VSAs) or directory claims from an external identity provider (such as RADIUS, LDAP, TACACS+, or Federated IDP), an account can bypass administrative role restriction checks during session establishment.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 8, 2026 · NIST NVD

    Detected

    Brocade Fabric OS versions before 10.0.1 contain an authorization logic vulnerability in the AAA (Authentication, Authorization, and Accounting) integration framework allows remote authenticated users to gain root-equivalent chassis access controls. By returning specific, crafted Vendor-Specific Attributes (VSAs) or directory claims from an external identity provider (such as RADIUS, LDAP, TACACS+

  2. Oct 14, 2026 · NIST NVD

    Updated

    Brocade Fabric OS versions before 10.0.1 contain an authorization logic vulnerability in the AAA (Authentication, Authorization, and Accounting) integration framework allows remote authenticated users to gain root-equivalent chassis access controls. By returning specific, crafted Vendor-Specific Attributes (VSAs) or directory claims from an external identity provider (such as RADIUS, LDAP, TACACS+

Affected

  • cpe broadcom/fabric operating systemversion unspecified

Sources

  • CVE.orgCVE-2026-94578

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2026-94578

    30-day exploitation probability 0.2%

    first.org
  • NIST NVDCVE-2026-94578

    Brocade Fabric OS versions before 10.0.1 contain an authorization logic vulnerability in the AAA (Authentication, Authorization, and Accounting) integration framework allows remote authenticated users to gain root-equivalent chassis access controls. By returning specific, crafted

    nvd.nist.gov

References