---
id: CVE-2026-94585
title: >-
  An authentication bypass vulnerability exists in the web management interface
  of Brocade Fabric OS versions before 9.2.2d running on the MXG610 platform
summary: >-
  An authentication bypass vulnerability exists in the web management interface
  of Brocade Fabric OS versions before 9.2.2d running on the MXG610 platform. An
  unauthenticated, network-adjacent attacker can exploit an unauthenticated
  endpoi…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-288
vendor: broadcom
product: fabric_operating_system
affected:
  - fabric_operating_system < 9.2.2d
patched:
  - fabric_operating_system 9.2.2d
published: '2026-10-08'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T19:35:47.137'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-94585'
references:
  - url: 'https://support.broadcom.com/external/content/SecurityAdvisories/0/39134'
    label: sirt@brocade.com
tags:
  - nvd
  - cve.org
epss: 0.00186
epssPercentile: 0.08171
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-08T15:18:49.962411Z'
scores:
  nvd: 8.8
  cna: 7.7
ingestedAt: '2026-10-08T05:05:36.675Z'
---

## Overview

An authentication bypass vulnerability exists in the web management interface of Brocade Fabric OS versions before 9.2.2d running on the MXG610 platform. An unauthenticated, network-adjacent attacker can exploit an unauthenticated endpoint within the Single Sign-On (SSO) workflow to gain administrative access to the device management interface.

## Affected

- `fabric_operating_system < 9.2.2d`

## Remediation

Upgrade past the affected range:

- `fabric_operating_system 9.2.2d`