CVE-2026-94578 is a high severity (CVSS 8.8) authorization flaw in the AAA integration of Brocade Fabric OS before 10.0.1. A remote authenticated user whose directory returns crafted attributes can bypass administrative role checks at session setup. Check Broadcom's advisory for the fixed build.
What's affected
The record says Fabric OS versions before 10.0.1 are affected, which is a wider range than the other Fabric OS issues published together. The weakness is CWE-269, improper privilege management.
Per the record, the AAA framework that connects the switch to an external identity provider, such as RADIUS, LDAP, TACACS+ or a federated provider, can be abused. By returning specific crafted vendor specific attributes or directory claims, an account can bypass administrative role restriction checks during session establishment and gain root-equivalent chassis access controls.
The vector is network, low complexity, low privileges. In practice the attacker needs an account that the directory will authenticate, plus influence over what the directory returns for that account. I could not load Broadcom's advisory, so confirm the fixed build there.
How to check if you're exposed
Read the Fabric OS version on each switch from its command line.
version
firmwareshow
Compare the result with the ranges in the record. For this issue the record says everything before 10.0.1 is affected.
Because the advisory pages need a browser session, open the Broadcom advisory in your own support account to see the fixed builds for your hardware and train. Record the version of every switch, including those in remote sites and lab fabrics, since fabrics are often managed by a different team than the servers they serve.
Then look at how the switch is wired to your directory.
aaaconfig --show
Note which authentication servers and role mappings are in use, and who can edit attributes or group claims in those systems.
What to do now
- Open Broadcom advisory 39150 and apply the fixed Fabric OS build, which per the record is 10.0.1 or later for this issue.
- Review who can edit user attributes and group membership in your RADIUS, LDAP, TACACS+ or federated directory, since those values drive switch roles.
- Review role mappings on the switch and use the narrowest mapping that works.
- Audit recent administrative sessions on the switches against the people who should have them.
- Keep management interfaces on a restricted network.
Why it matters
External identity systems make switch accounts easier to manage, but they also move part of the trust decision off the device. The switch trusts what the directory says about a user. If a user, or someone who can edit directory data, can shape that answer, the switch may grant more than intended. CWE-269 is about granting and tracking privilege correctly.
The practical lesson is to treat the directory attributes that map to switch roles as sensitive administrative data. The record does not mark exploitation, and the CVE is not in CISA's catalog.
Quick check
Which versions does this affect?
The record says Fabric OS before 10.0.1. Other issues in the same batch use before 9.2.2d and 10.0.0 through 10.0.0a1.
Does it matter which directory I use?
The record names RADIUS, LDAP, TACACS+ and federated providers as examples of the external services involved.
Sources
Last reviewed: 18 October 2026.
