ZeroDay Findings
Sign inSign up

Findings

CVE-2026-94579

An OS command injection vulnerability exists in the PAM (Pluggable Authentication Module) session cleanup routines during SSH session termination on Brocade Fabric OS…

Published Oct 8, 2026 · updated Oct 14, 2026 · broadcom fabric operating system

An OS command injection vulnerability exists in the PAM (Pluggable Authentication Module) session cleanup routines during SSH session termination on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user authenticating via an external directory or AAA service whose username or profile identifier contains shell metacharacters can trigger arbitrary command execution with root privileges when their remote SSH session closes.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 8, 2026 · NIST NVD

    Detected

    An OS command injection vulnerability exists in the PAM (Pluggable Authentication Module) session cleanup routines during SSH session termination on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user authenticating via an external directory or AAA service whose username or profile identifier contains shell metacharacters can trigger arbitrary command execut

  2. Oct 14, 2026 · NIST NVD

    Updated

    An OS command injection vulnerability exists in the PAM (Pluggable Authentication Module) session cleanup routines during SSH session termination on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user authenticating via an external directory or AAA service whose username or profile identifier contains shell metacharacters can trigger arbitrary command execut

Affected

  • cpe broadcom/fabric operating systemversion unspecified

Sources

  • CVE.orgCVE-2026-94579

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2026-94579

    30-day exploitation probability 2.6%

    first.org
  • NIST NVDCVE-2026-94579

    An OS command injection vulnerability exists in the PAM (Pluggable Authentication Module) session cleanup routines during SSH session termination on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user authenticating via an external director

    nvd.nist.gov

References