CVE-2026-94576: fabric operating — Fix

Description

An authentication logic and privilege escalation vulnerability exists in the account management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. Under specific conditions, an authenticated user can bypass authorization restrictions intended to prevent modifying another account's access privileges. Exploitation allows a lower-privileged user to assign administrative roles to a target account, leading to localized privilege escalation.

Is your site exposed to CVE-2026-94576?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

8.0

HIGH

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS — Exploit Prediction

0.0043

Probability of exploitation

0.38%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-187 CWE-187

Affected Products

Vendor	Product	Versions
broadcom	fabric_operating_system	< 9.2.2d
broadcom	fabric_operating_system	10.0.0 — 10.0.1

References

Advisories & Patches

https://support.broadcom.com/external/content/SecurityAdvisories/0/39156

Frequently Asked Questions

What is CVE-2026-94576? +

An authentication logic and privilege escalation vulnerability exists in the account management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. Under specific conditions, an authenticated user can bypass authorization restrictions intended to prevent modifying another account's access privileges. Exploitation allows a lower-privileged user to assign administrative roles to a target account, leading to localized privilege escalation. It has a CVSS v3.1 base score of 8.0 (HIGH).

How severe is CVE-2026-94576? +

CVE-2026-94576 has a CVSS v3.1 score of 8.0 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching. The EPSS score is 0.0043, placing it in the 0th percentile for exploitation probability.

What products are affected by CVE-2026-94576? +

CVE-2026-94576 affects products from broadcom, specifically: fabric_operating_system. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2026-94576? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-41110 9.9

Moby is an open-source project created by Docker for software containerization. A security vulnerability has been detected in certain versions …

CVE-2024-39742 8.1

IBM MQ Operator 3.2.2 and IBM MQ Operator 2.0.24 could allow a user to bypass authentication under certain configurations due …

CVE-2026-87853 7.5

A flaw was found in SSSD's IdP authentication provider. The eval_access_token_buf() function compares the OIDC subject identifier using strncmp() with …

CVE-2026-101914 6.5

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.1 and 1.14.1, the …

CVE-2026-112266 5.9

SGLang through 0.5.22 contains a denial of service vulnerability that allows API clients to abort other users' in-flight generation requests …

CVE-2026-44837 5.9

view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3.0.0 to 4.9.0, …

CVE-2026-94576