CVE-2026-94582 is a high severity (CVSS 7.8) buffer overflow in the internal diagnostic and route validation code of the FSPF routing component in Brocade Fabric OS before 10.0.1. The record says the path is not directly reachable through normal interfaces. Check Broadcom's advisory for the fixed build.
What's affected
The record says Fabric OS versions before 10.0.1 are affected. The weakness is CWE-120, a classic buffer copy without checking the size of input.
The code is in the Fabric Shortest Path First protocol component, in routines used for diagnostics and route validation. The record states that this path is not directly accessible through standard user interfaces or CLI management commands. An input processing flaw lets incoming or internally routed diagnostic state payloads go past allocated memory.
The record adds that an attacker would have to chain or link other vulnerabilities to exploit the diagnostic path. The result could be a heap or stack overrun, with a crash of the routing daemon or possible code execution in the daemon's context. The vector is local with high attack complexity. I could not load Broadcom's advisory, so use it to confirm the fixed build.
How to check if you're exposed
Read the Fabric OS version on each switch from its command line.
version
firmwareshow
Compare the result with the ranges in the record. For this issue the record says everything before 10.0.1 is affected.
Because the advisory pages need a browser session, open the Broadcom advisory in your own support account to see the fixed builds for your hardware and train. Record the version of every switch, including those in remote sites and lab fabrics, since fabrics are often managed by a different team than the servers they serve.
Also check the health of routing daemons in your logs, since a crash is the visible sign of this bug class.
What to do now
- Open Broadcom advisory 39161 and apply the fixed Fabric OS build, which per the record is 10.0.1 or later.
- Treat this as lower urgency than the account and authentication issues in the same batch, but include it in the same maintenance window.
- Keep switch management interfaces isolated and review who holds accounts.
- Watch switch logs for routing daemon restarts and investigate any that you cannot explain.
- Record the fixed version in your inventory so the next audit finds it.
Why it matters
CWE-120 bugs sit in code that copies data without checking that it fits. This one is in a diagnostic helper, which is why the record stresses that it is not exposed through ordinary management commands. That lowers the immediate risk, because an attacker needs another weakness to reach it first.
The lesson is about chains. A flaw that is hard to reach alone can become useful after an access flaw, such as the privilege issues published for the same product on the same day. Patching the whole batch closes both links. The record does not mark exploitation, and the CVE is not in CISA's catalog.
Quick check
Can I reach this from the CLI?
The record says the code is not directly accessible through standard user interfaces or CLI management commands.
What is the worst case?
A crash of the routing daemon, or possible code execution in its context, according to the record.
Sources
Last reviewed: 18 October 2026.
