---
id: CVE-2026-94576
title: >-
  An authentication logic and privilege escalation vulnerability exists in the
  account management interface of Brocade Fabric OS versions before 9.2.2d and
  10.0.0 through 10.0.0a1
summary: >-
  An authentication logic and privilege escalation vulnerability exists in the
  account management interface of Brocade Fabric OS versions before 9.2.2d and
  10.0.0 through 10.0.0a1. Under specific conditions, an authenticated user can
  bypas…
severity: high
cvss: 8
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-187
vendor: broadcom
product: fabric_operating_system
affected:
  - fabric_operating_system < 9.2.2d
  - 'fabric_operating_system >= 10.0.0, < 10.0.1'
patched:
  - fabric_operating_system 10.0.1
published: '2026-10-08'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T19:34:13.170'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-94576'
references:
  - url: 'https://support.broadcom.com/external/content/SecurityAdvisories/0/39156'
    label: sirt@brocade.com
tags:
  - nvd
  - cve.org
  - score-dispute
epss: 0.00433
epssPercentile: 0.37422
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-08T17:21:12.252476Z'
scores:
  nvd: 8
  cna: 5.9
ingestedAt: '2026-10-08T05:05:36.676Z'
---

## Overview

An authentication logic and privilege escalation vulnerability exists in the account management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. Under specific conditions, an authenticated user can bypass authorization restrictions intended to prevent modifying another account's access privileges. Exploitation allows a lower-privileged user to assign administrative roles to a target account, leading to localized privilege escalation.

## Affected

- `fabric_operating_system < 9.2.2d`
- `fabric_operating_system >= 10.0.0, < 10.0.1`

## Remediation

Upgrade past the affected range:

- `fabric_operating_system 10.0.1`