CVE-2026-94576 is a high severity (CVSS 8.0) authorization flaw in the account management interface of Brocade Fabric OS before 9.2.2d, and 10.0.0 through 10.0.0a1. A lower-privileged authenticated user can assign administrative roles to a target account. Check Broadcom's advisory for the fixed build.
What's affected
The record lists Brocade Fabric OS versions before 9.2.2d, and 10.0.0 through 10.0.0a1, as affected. The weakness is CWE-187, partial string comparison, which points to a check that compares only part of a value.
The record describes an authentication logic and privilege escalation flaw in the account management interface. Under specific conditions an authenticated user can bypass the restriction that stops them from changing another account's access privileges, and so give an account administrative roles. The record calls the result localized privilege escalation.
The CVSS vector is adjacent network, low complexity, low privileges, with high impact on confidentiality, integrity and availability. I could not load Broadcom's advisory, so I cannot confirm the fixed build numbers beyond what the record's ranges imply. Treat the advisory as the authority.
How to check if you're exposed
Read the Fabric OS version on each switch from its command line.
version
firmwareshow
Compare the result with the ranges in the record. Anything earlier than 9.2.2d, and the 10.0.0 to 10.0.0a1 range, is in scope per the record.
Because the advisory pages need a browser session, open the Broadcom advisory in your own support account to see the fixed builds for your hardware and train. Record the version of every switch, including those in remote sites and lab fabrics, since fabrics are often managed by a different team than the servers they serve.
Then list accounts and roles and compare them with what you expect.
userconfig --show -a
What to do now
- Open Broadcom advisory 39156 and apply the fixed Fabric OS build for your platform and release train.
- Review the accounts and roles on every switch and remove any administrative role you cannot explain.
- Limit who holds accounts on the switches at all. Use centrally managed accounts with the least privilege that works.
- Keep switch management interfaces on an isolated management network, not on general user networks.
- Plan the firmware change through your normal change window, since switch upgrades need a maintenance plan.
Why it matters
Storage fabrics carry the data paths between servers and arrays, and administrative access to a switch is control over those paths. A flaw that lets a low privilege account hand out administrative roles breaks the separation of duties that operators rely on. CWE-187 describes a comparison that stops too early, which is the sort of defect that survives testing because the common cases pass.
The vector is adjacent network, which limits exposure to people who can already reach the management network. The record does not mark exploitation and the CVE is not in CISA's catalog. The main risk is an insider or a compromised low privilege account.
Quick check
Can someone exploit this from the internet?
The vector is adjacent network and needs an authenticated account, so the exposure is mostly to people already on the management network.
Where do I find the fixed version?
In Broadcom's advisory 39156, which the record references. I could not load it, so confirm there.
Sources
Last reviewed: 18 October 2026.
