CVE-2026-94578

Executive Summary

CVE-2026-94578 is an authorization logic vulnerability in the AAA (Authentication, Authorization, and Accounting) integration framework of Brocade Fabric OS versions prior to 10.0.1. A remote, authenticated attacker can supply crafted Vendor-Specific Attributes (VSAs) or directory claims from an external identity provider (RADIUS, LDAP, TACACS+, or Federated IDP) to bypass administrative role restriction checks during session establishment, obtaining root-equivalent chassis access. Because the flaw resides in the trust boundary between the switch and the identity provider, any organization that delegates Fabric OS authentication to an external AAA server is exposed.

Technical Analysis

The vulnerability is classified as CWE-269 (Improper Privilege Management) and resides in the AAA integration framework that mediates authentication, authorization, and accounting between Brocade Fabric OS and external identity providers. In a correctly functioning AAA integration, the switch validates authorization data returned by the identity provider — specifically Vendor-Specific Attributes (VSAs) in RADIUS and TACACS+ responses, directory claims in LDAP, and Federated IDP assertions — and then applies administrative role restriction checks during session establishment to determine the privilege level granted to the authenticated account.

Per the NVD description, Fabric OS versions before 10.0.1 fail to correctly enforce those role restriction checks when processing the returned authorization data. By returning specific, crafted VSAs or directory claims, an account that has already authenticated successfully can cause the session-establishment logic to skip or mis-evaluate the administrative role restriction checks, resulting in root-equivalent chassis access controls being assigned to that session. The attack surface is the AAA/identity-provider integration path: the network-facing authentication interfaces on the switch that consume RADIUS, LDAP, TACACS+, and Federated IDP responses.

Key observations derived strictly from the provided data:

• The flaw is an authorization logic error, not an authentication bypass. The attacker must be a remote authenticated user — they possess valid credentials recognized by the identity provider. The escalation occurs in the privilege-assignment phase of session establishment.
• The controllable input is the authorization attribute data returned by the identity provider: VSAs (RADIUS, TACACS+) and directory claims (LDAP, Federated IDP). This implies an attacker who can influence, modify, or operate the identity provider response path — or who holds an account whose attributes can be crafted — can drive the vulnerable check.
• The impact is privilege escalation to root-equivalent chassis access on the affected Fabric OS device. Chassis-level access on a fibre channel switch is a highly sensitive position: it governs fabric-wide configuration, zoning, and security policy.

Sibling CWE-269 findings in network operating systems commonly include missing server-side validation of role attributes, failure to compare the asserted role against a configured maximum, default-allow logic when an attribute is absent or malformed, and "fail open" behavior when the AAA response contains unexpected or duplicate attributes. Consistent with the NVD description, the mechanism here is that role restriction checks during session establishment are bypassed rather than that authentication itself is defeated.

Insufficient technical detail is available in the provided data to identify specific function names, configuration parameters, attribute OIDs, or code paths; no such identifiers are asserted in the NVD description and none should be inferred.

Exploitation Scenarios

Note: No public PoC is available. The attack chain below is inferred from the vulnerability class (authorization logic error in AAA integration, CWE-269) and the NVD description. No specific implementation details are fabricated.

1. Reconnaissance / target identification. The attacker identifies Brocade Fabric OS switches with AAA integration enabled (RADIUS, LDAP, TACACS+, or Federated IDP) and running a version prior to 10.0.1. Because the attack requires remote authentication, the attacker needs a valid account on the integrated identity provider, or the ability to influence the attributes the identity provider returns for an account they control.

2. Triggering the flaw. The attacker authenticates normally to the switch through the configured AAA integration. During session establishment, the switch requests or receives authorization data from the external identity provider. The attacker causes the identity provider to return crafted VSAs or directory claims. This can be achieved either by (a) controlling or compromising an account whose directory/AAA attributes can be authored, (b) operating a rogue or redirected identity provider that the switch trusts, or (c) tampering with the identity provider response in transit if the AAA channel is not cryptographically protected. Because role restriction checks during session establishment are not correctly enforced in affected versions, the crafted attribute data is accepted and the role restriction check is bypassed.

3. Payload/execution method. At the vulnerability-class level, the "payload" is the malicious authorization attribute set — crafted VSAs (RADIUS/TACACS+) or directory claims (LDAP/Federated IDP) — that the switch consumes as authoritative authorization input. No file path, request parameter, or code symbol is specified in the available data. The execution is the normal AAA response processing path; the attacker does not need to exploit a memory-safety bug or deliver a binary payload.

4. Post-exploitation impact. A successful bypass grants the attacker root-equivalent chassis access controls on the Fabric OS switch. From that position, the attacker can alter fabric configuration, modify zoning and security policy, create or modify accounts and roles, and pivot within the storage area network. Given the sensitivity of FC switching infrastructure, this represents a significant control-plane compromise rather than a localized information disclosure.

Automation risk is currently low. The EPSS score is 0.00236 (13.4th percentile of exploited CVEs), there is no CISA KEV listing, no public PoC, no exploit code, and no Nuclei template. Exploitation in the wild has not been observed in the tracked data.

Impact Assessment

Successful exploitation yields root-equivalent chassis access on the affected Fabric OS switch. CVSS 3.1 base metrics for this vulnerability, derived from the described mechanism, are:

• Attack Vector: Network (AV:N) — the AAA integration is reachable over the network.
• Attack Complexity: Low (AC:L) — no special conditions are required beyond crafting the attribute response.
• Privileges Required: Low (PR:L) — the attacker must be authenticated as a user (the description states "remote authenticated users").
• User Interaction: None (UI:N) — no victim action is required.
• Scope: Changed (S:C) — the session's privilege context is elevated to root-equivalent chassis access, crossing a security authority boundary.
• Confidentiality: High (C:H) — chassis access exposes fabric configuration and data.
• Integrity: High (I:H) — zone sets, security policy, and device configuration can be altered.
• Availability: High (A:H) — misconfiguration or malicious reconfiguration can disrupt the SAN fabric.

These subscores reflect the vulnerability class and the stated impact; they should be validated against the vendor's own advisory when published. The blast radius extends beyond the single switch: a compromised fabric switch with admin-level access can affect hosts and storage attached to that fabric. Organizations that centralize AAA across many switches may have a shared identity provider, meaning a single crafted attribute path could scale across the estate. The EPSS score of 0.00236 places this in the lower exploitation-likelihood band, so prioritization should weigh exposure (number of pre-10.0.1 switches with external AAA) against current threat activity.

Detection Guidance

Sigma Rule

title: Brocade Fabric OS AAA Role Restriction Bypass - Privileged Session Establishment
id: 8f3c2a71-4b6e-4d1e-9c2a-7f0b6d5e4a11
status: experimental
description: Detects Fabric OS AAA session establishment where authorization data originates from an external identity provider and the resulting session receives root-equivalent chassis access, consistent with CVE-2026-94578.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-94578
author: valtersit.com
date: 2026-01-01
tags:
  - attack.privilege_escalation
  - attack.t1078
logsource:
  product: brocade
  service: fabric_os
detection:
  selection_aaa:
    action: 'session-establish'
    auth_source: 'external'
  selection_idp:
    identity_provider:
      - 'radius'
      - 'ldap'
      - 'tacacs+'
      - 'federated-idp'
  selection_role:
    role_assigned|contains:
      - 'admin'
      - 'root'
      - 'chassis'
  condition: selection_aaa and selection_idp and selection_role
fields:
  - user
  - src_ip
  - identity_provider
  - role_assigned
  - vsa_attributes
falsepositives:
  - Legitimate administrative logins through the identity provider
  - Manual role-assignment changes by authorized admins
level: high

YARA Rule

rule CVE_2026_94578_Brocade_FabricOS_AAA_RoleBypass
{
    meta:
        description = "Detects references to AAA role restriction bypass in Brocade Fabric OS before 10.0.1 (CVE-2026-94578)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-94578"
        date = "2026-01-01"
        severity = "high"

    strings:
        $vsa1 = "Vendor-Specific" ascii nocase
        $vsa2 = "VSA" ascii
        $aaa1 = "AAA" ascii
        $aaa2 = "Authentication, Authorization, and Accounting" ascii nocase
        $idp1 = "RADIUS" ascii nocase
        $idp2 = "TACACS" ascii nocase
        $idp3 = "LDAP" ascii nocase
        $role1 = "role restriction" ascii nocase
        $role2 = "chassis access" ascii nocase

    condition:
        (uint16(0) == 0x0a0d or uint16(0) == 0x0d0a or true) and
        filesize < 5MB and
        2 of ($aaa*) and
        1 of ($vsa*) and
        $idp1 and
        1 of ($role*)
}

Suricata IDS Rule

alert tcp any any -> any 1812 (msg:"CVE-2026-94578 Brocade Fabric OS AAA Role Restriction Bypass Attempt (RADIUS)"; flow:to_server,established; content:"|01|"; offset:0; depth:1; content:"Vendor-Specific"; nocase; content:"admin"; nocase; threshold:type both, track by_src, count 5, seconds 60; reference:cve,2026-94578; classtype:attempted-admin; sid:9000001; rev:1;)

alert tcp any any -> any 1813 (msg:"CVE-2026-94578 Suspected Malicious RADIUS Authorization Response with Crafted VSA"; flow:to_client,established; content:"Vendor-Specific"; nocase; content:"admin"; nocase; reference:cve,2026-94578; classtype:attempted-admin; sid:9000002; rev:1;)

alert tcp any any -> any 49 (msg:"CVE-2026-94578 Brocade Fabric OS TACACS+ Authorization Role Manipulation"; flow:to_server,established; content:"admin"; nocase; content:"root"; nocase; threshold:type both, track by_src, count 5, seconds 60; reference:cve,2026-94578; classtype:attempted-admin; sid:9000003; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ authentication where event.action == "authentication_success" and event.outcome == "success" and network.protocol in ("radius", "ldap", "tacacs", "tacacs+") ]
  [ authentication where event.action == "session_establish" and event.outcome == "success" and process.name : "aaa" and user.roles : ("admin", "root", "chassis") ]

Splunk SPL Query

index=network sourcetype=brocade:fabric_os
(action=session-establish OR action=authentication OR event_type=aaa)
(auth_source=external OR identity_provider="*")
(identity_provider IN ("radius","ldap","tacacs+","tacacs","federated-idp")
 OR vsa_attributes=* OR directory_claims=*)
(role_assigned IN ("admin","root","chassis") OR role_assigned="*admin*")
| eval suspicious=if(match(role_assigned,"(?i)admin|root|chassis"),1,0)
| stats count values(identity_provider) as providers values(role_assigned) as roles by user src_ip
| where count >= 1
| sort - count

Wazuh OSSEC Rule

<group name="brocade,fabric_os,">
  <rule id="100642" level="12">
    <decoded_as>json</decoded_as>
    <field name="action">session-establish</field>
    <field name="auth_source">external</field>
    <field name="identity_provider">radius|ldap|tacacs\+|federated-idp</field>
    <field name="role_assigned">admin|root|chassis</field>
    <description>CVE-2026-94578: Brocade Fabric OS potential AAA role restriction bypass granting privileged chassis access</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>privilege_escalation,</group>
  </rule>

  <rule id="100643" level="10">
    <decoded_as>json</decoded_as>
    <field name="action">aaa-attribute</field>
    <field name="vsa_attributes">\.</field>
    <field name="role_assigned">admin|root|chassis</field>
    <description>CVE-2026-94578: Suspicious AAA VSA/directory claim associated with privileged role assignment</description>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 — UNPATCHED. No patch evidence has been identified from any tracked source, and no vendor fix, workaround, or affected-version package data is available in the provided intelligence. All guidance below is mitigating rather than remediating, with the exception of the vendor's stated fixed version.

1. Immediate mitigations.

   • Treat external AAA role data as untrusted input. Where possible, configure the switch to enforce a locally defined maximum role for each account rather than accepting the role asserted by the identity provider.
   • Restrict the ability to author or modify VSAs and directory claims to a tightly controlled set of identity-administrator accounts; audit those rights.
   • Protect the AAA channel cryptographically — enforce RADIUS message authentication/IPsec for RADIUS, TLS for LDAP, and authenticated/encrypted TACACS+ or Federated IDP transport — so attribute responses cannot be tampered with in transit.
   • Limit network reachability of switch management and AAA interfaces to trusted management networks.
   • Monitor for the detection signals in the Detection Guidance section, especially successful session establishment with admin/root/chassis roles from external identity providers.

2. Patch / upgrade steps.

   • The fixed version is Brocade Fabric OS 10.0.1. Plan an upgrade of all Fabric OS devices running versions earlier than 10.0.1 to 10.0.1 or later, following the vendor's upgrade and interoperability guidance.
   • Until the upgrade is validated, apply the role-restriction mitigations above on all pre-10.0.1 devices.

3. Long-term hardening.

   • Adopt a least-privilege identity model in the AAA provider so that administrative roles are only ever asserted to accounts that genuinely require them.
   • Implement continuous configuration and firmware-version monitoring so devices below the fixed version are detected and remediated promptly.
   • Log and alert on all AAA attribute data flows and periodic review of role mappings.
   • Maintain an inventory of Fabric OS devices and their AAA integration trust relationships as part of normal attack-surface management.

References

• NVD entry for CVE-2026-94578: https://nvd.nist.gov/vuln/detail/CVE-2026-94578
• MITRE CWE-269 (Improper Privilege Management): https://cwe.mitre.org/data/definitions/269.html
• Brocade / Broadcom Fabric OS security advisories and release notes for version 10.0.1 (consult the vendor's official security advisory portal; no specific advisory URL is provided in the available data)
• FIRST EPSS: https://www.first.org/epss/ (score 0.00236, 13.4th percentile)
• CISA Known Exploited Vulnerabilities catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-94578 is NOT listed as of this report)

No threat actor campaigns or exploit-in-the-wild evidence have been identified for this CVE in the tracked data. POC status: None. Nuclei template: No. Exploit code: No.