CVE-2026-94578

Katalog CVE

CVSS 7.5 · High EPSS 0,24%

Kerentanan Improper Privilege Management. Skor CVSS 4.0 7.5 (High) menurut brocade.com.

Deskripsi (NVD)

Brocade Fabric OS versions before 10.0.1 contain an authorization logic vulnerability in the AAA (Authentication, Authorization, and Accounting) integration framework allows remote authenticated users to gain root-equivalent chassis access controls. By returning specific, crafted Vendor-Specific Attributes (VSAs) or directory claims from an external identity provider (such as RADIUS, LDAP, TACACS+, or Federated IDP), an account can bypass administrative role restriction checks during session establishment.

Rincian

Terbit di NVD

8 Oktober 2026

Terakhir diubah

8 Oktober 2026

Status NVD

Awaiting Analysis

CVSS 4.0

7.5 (High), sumber brocade.com
CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-269: Improper Privilege Management

EPSS (30 hari)

0,24% peluang dieksploitasi; lebih tinggi dari 13,5% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://support.broadcom.com/external/content/SecurityAdvisories/0/39150