CVE-2026-94577 is a high severity (CVSS 7.8) privilege escalation in the internal CLI authorization handling of Brocade Fabric OS before 9.2.2d, and 10.0.0 through 10.0.0a1. An authenticated user or local process that can alter the execution environment can bypass role checks and reach root. Check Broadcom's advisory.
What's affected
The record lists Fabric OS before 9.2.2d, and 10.0.0 through 10.0.0a1. The weakness is CWE-15, external control of system or configuration setting.
Per the record, the CLI authorization mechanism can be bypassed by an authenticated user, or a local process, that can manipulate the process execution environment. A successful attacker bypasses role based access control validation and raises their privileges to root.
The CVSS vector is local, low complexity, low privileges, with high impact on confidentiality, integrity and availability. That fits the description: the attacker already has a foothold on the device. I could not load Broadcom's advisory, so confirm the fixed builds there.
How to check if you're exposed
Read the Fabric OS version on each switch from its command line.
version
firmwareshow
Compare the result with the ranges in the record. The same ranges apply as for the other Fabric OS issues published together: before 9.2.2d, and 10.0.0 through 10.0.0a1.
Because the advisory pages need a browser session, open the Broadcom advisory in your own support account to see the fixed builds for your hardware and train. Record the version of every switch, including those in remote sites and lab fabrics, since fabrics are often managed by a different team than the servers they serve.
Also list who can log in to a shell or CLI session on the switch, since this issue needs a foothold first.
What to do now
- Open Broadcom advisory 39154 and apply the fixed Fabric OS build for your platform.
- Review local and directory accounts that can reach the CLI, and remove those you do not need.
- Restrict management access to a dedicated network and to named administrator hosts.
- Apply the firmware updates for the other Fabric OS issues published in the same batch in one change window to save effort.
- Monitor switch logs for unexpected role changes or shell sessions.
Why it matters
Role based access control on a switch only works if the process enforcing it cannot be steered by the user it is checking. When a user can shape the environment in which the authorization helper runs, the check can be made to approve things it should refuse. CWE-15 captures that: a setting that should be controlled by the system is influenced from outside.
Because the attacker needs a login or a local process first, this is a second stage flaw. It matters most when another bug or a stolen low privilege credential has already given the attacker a way in. The record does not mark exploitation, and the CVE is not in CISA's catalog.
Quick check
Does the attacker need an account?
Yes, an authenticated user or a local process on the device, per the record.
What does success give them?
Root privileges on the switch, according to the record.
Sources
Last reviewed: 18 October 2026.
