CVE-2026-94578

Broadcom Fabric Operating System: privilege escalation

Risk score: 59/100
CVSS: 8.8 v3.1
Exploit chance (30 days): 0.4%
Published: 8 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: Brocade Fabric OS versions before 10.0.1 contain an authorization logic vulnerability in the AAA (Authentication, Authorization, and Accounting) integration framework allows remote authenticated users to gain root-equivalent chassis access controls. By returning specific, crafted Vendor-Specific Attributes (VSAs) or d…
Affected: Broadcom Fabric Operating System before 10.0.1
Fix: Upgrade Broadcom Fabric Operating System to 10.0.1 or later.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Broadcom Fabric Operating System: Amber, patch this week. A stack-based buffer overflow vulnerability exists in the SNMP daemon request handling of Brocade Fabric versions before 10.0.1. When processing an incoming SNMPv3 packet, an internal statistics gathering handler copies user-supplied context name data into a fixed-size buffer without properly validating the length of …

The flaws

CVE-2026-94578: Privilege escalation (CVSS 8.8 · EPSS 0%)
CVE-2026-87684: Stack buffer overflow can lead to remote code execution (CVSS 9.8 · EPSS 1%)
CVE-2026-87680: OS command injection (CVSS 8.8 · EPSS 2%)
CVE-2026-87682: OS command injection (CVSS 8.8 · EPSS 2%)

The fix

Upgrade Broadcom Fabric Operating System: 10.0.1 or later on your release line

Who is exposed: Broadcom Fabric Operating System before 10.0.1

Where it stands

No known exploitation

Connects to

Same weakness: Privilege escalation (CWE-269). 156 other warnings in 30 days
Same product: Earlier Broadcom Fabric Operating System warnings. 39 in the last 90 days

Why it is Yellow

CVSS 8.8 high

References

https://support.broadcom.com/external/content/SecurityAdvisories/0/39150

Original description

Brocade Fabric OS versions before 10.0.1 contain an authorization logic vulnerability in the AAA (Authentication, Authorization, and Accounting) integration framework allows remote authenticated users to gain root-equivalent chassis access controls. By returning specific, crafted Vendor-Specific Attributes (VSAs) or directory claims from an external identity provider (such as RADIUS, LDAP, TACACS+, or Federated IDP), an account can bypass administrative role restriction checks during session establishment.

Last activity 8 Oct 2026. Patch Forecast updates every hour.