CVE-2026-94575: fabric operating — Fix

Description

A logic vulnerability in Brocade Fabric OS versions before 10.0.1 web management framework allows an authenticated, low-privileged user to bypass inner Role-Based Access Control (RBAC) checks under specific environmental conditions. Successful exploitation lowers the system authorization mode for the active session context, allowing access to restricted configuration settings intended exclusively for administrative roles.

Is your site exposed to CVE-2026-94575?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

5.7

MEDIUM

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

EPSS — Exploit Prediction

0.0017

Probability of exploitation

0.07%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-483 CWE-483

Affected Products

Vendor	Product	Versions
broadcom	fabric_operating_system	< 10.0.1

References

Advisories & Patches

https://support.broadcom.com/external/content/SecurityAdvisories/0/39157

Frequently Asked Questions

What is CVE-2026-94575? +

A logic vulnerability in Brocade Fabric OS versions before 10.0.1 web management framework allows an authenticated, low-privileged user to bypass inner Role-Based Access Control (RBAC) checks under specific environmental conditions. Successful exploitation lowers the system authorization mode for the active session context, allowing access to restricted configuration settings intended exclusively for administrative roles. It has a CVSS v3.1 base score of 5.7 (MEDIUM).

How severe is CVE-2026-94575? +

CVE-2026-94575 has a CVSS v3.1 score of 5.7 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance. The EPSS score is 0.0017, placing it in the 0th percentile for exploitation probability.

What products are affected by CVE-2026-94575? +

CVE-2026-94575 affects products from broadcom, specifically: fabric_operating_system. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2026-94575? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-23614 10.0

A buffer overflow vulnerability exists in Symantec Messaging Gateway versions 9.5 and before. A remote, anonymous attacker can exploit this …

CVE-2024-23615 10.0

A buffer overflow vulnerability exists in Symantec Messaging Gateway versions 10.5 and before. A remote, anonymous attacker can exploit this …

CVE-2024-23616 10.0

A buffer overflow vulnerability exists in Symantec Server Management Suite version 7.9 and before. A remote, anonymous attacker can exploit …

CVE-2024-23613 10.0

A buffer overflow vulnerability exists in Symantec Deployment Solution version 7.9 when parsing UpdateComputer tokens. A remote, anonymous attacker can …

CVE-2026-87659 9.8

A critical authorization bypass vulnerability exists in the Management Server handling of Brocade Fabric OS versions before 10.0.1. A compromised …

CVE-2025-8660 9.8

Privilege escalation occurs when a user gets access to more resources or functionality than they are normally allowed.