CVE-2026-94585 is a high severity (CVSS 8.8) authentication bypass in the web management interface of Brocade Fabric OS before 9.2.2d on the MXG610 platform. An unauthenticated attacker on the adjacent network can gain administrative access through an endpoint in the single sign-on workflow.
What's affected
The record lists Fabric OS before 9.2.2d running on the MXG610 platform, and its product list includes the Dell MXG610S. The weakness is CWE-288, authentication bypass using an alternate path or channel.
Per the record, an unauthenticated endpoint within the single sign-on workflow of the web management interface lets a network adjacent attacker gain administrative access to the device management interface. The vector is adjacent network, low complexity, no privileges and some user interaction. I could not load Broadcom's advisory, so I cannot confirm the fixed build beyond the 9.2.2d boundary the record uses.
Unlike the other Fabric OS entries published the same day, this one is stated for the MXG610 platform only.
How to check if you're exposed
Read the Fabric OS version on each switch from its command line.
version
firmwareshow
Compare the result with the ranges in the record. This issue applies to the MXG610 platform running a version earlier than 9.2.2d.
Because the advisory pages need a browser session, open the Broadcom advisory in your own support account to see the fixed builds for your hardware and train. Record the version of every switch, including those in remote sites and lab fabrics, since fabrics are often managed by a different team than the servers they serve.
Identify which switches are MXG610 or Dell MXG610S units, for example from your hardware inventory, and check the web management interface exposure: who can reach it, and from which networks.
What to do now
- Open Broadcom advisory 39134 and apply the fixed Fabric OS build on every MXG610 unit.
- Limit the web management interface to a dedicated management network and named administrator hosts until the update is done.
- If you do not use the web interface, disable it where the platform allows and use the command line instead.
- Review administrative sessions and account changes on the affected switches for anything unexpected.
- If the MXG610 is part of a Dell blade enclosure, check Dell's guidance as well as Broadcom's.
Why it matters
An authentication bypass is worse than a privilege issue because the attacker needs no account. CWE-288 describes a login design where one entry point is checked and another path leads to the same result without a check. Single sign-on flows have several moving parts, and one unauthenticated endpoint is enough.
The adjacent network requirement limits who can attempt it, but management networks often include many hosts and sometimes shared lab or vendor access. The record does not mark exploitation, and the CVE is not in CISA's catalog. Treat the management network as part of the attack surface.
Quick check
Which hardware is affected?
The record names the MXG610 platform, with Dell MXG610S in its product list.
Do I need an account to attack it?
No. The record describes an unauthenticated attacker on the adjacent network.
Sources
Last reviewed: 18 October 2026.
