CVE-2026-94579

Executive Summary

CVE-2026-94579 is an OS command injection vulnerability in the PAM session cleanup routines of Brocade Fabric OS, triggered during SSH session termination. Any authenticated user who authenticates via an external directory or AAA service and whose username or profile identifier contains shell metacharacters can achieve arbitrary command execution with root privileges when their remote SSH session closes. Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 are affected, and no patch evidence has been identified from tracked sources.

Technical Analysis

The vulnerability resides in the PAM session cleanup path invoked when a remote SSH session terminates. PAM (Pluggable Authentication Module) is the standard Linux/Unix authentication framework, and Fabric OS uses it to integrate with external authentication sources such as LDAP, RADIUS, TACACS+, or other AAA services. When a remote SSH session ends, the PAM stack executes session cleanup routines (typically pam_close_session handlers) that often run privileged shell commands to release resources, clean up temporary environments, or notify external services.

The flaw class is CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The root cause is that the username or profile identifier obtained from the external directory or AAA service is passed into a shell command during session cleanup without proper sanitization or parameterization. If that identifier contains shell metacharacters (e.g., ;, |, `, $(), &&), the underlying shell interprets them as command separators or substitutions, resulting in arbitrary command execution.

Two key factors increase severity:

1. Execution context: PAM session cleanup runs with elevated privileges — in this case, root — so the injected command inherits root privileges. The NVD description explicitly states "arbitrary command execution with root privileges."
2. Trigger timing: The injection does not require an interactive shell or a crafted network packet; it triggers automatically when the SSH session closes. This makes the attack stealthy and repeatable, and it does not depend on the attacker maintaining an interactive session.

The attack surface is the SSH management interface of Brocade Fabric OS switches (Fibre Channel SAN switches and directors used for storage area networking). External authentication integrations are common in enterprise SAN environments where centralized identity management is required for compliance.

The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H — network-reachable, low attack complexity, low privileges required (any authenticated user), no user interaction, scope changed (a vulnerable software component — PAM cleanup — affects resources beyond its original authorization scope), and high confidentiality, integrity, and availability impact. The vector is provided here as an analytic assessment derived from the described characteristics; no CVSS score or vector was supplied in the source data.

Exploitation Scenarios

Based strictly on the NVD description, the attack chain is as follows. No public PoC or exploit code is available; the chain below is inferred from the vulnerability class.

1. Reconnaissance / target identification: An attacker identifies a Brocade Fabric OS device with an accessible SSH management interface that is configured to authenticate users via an external directory or AAA service. Target identification could be performed via network scanning for SSH (port 22) on known Brocade management addresses, or by leveraging existing knowledge of the organization's SAN switch inventory.

2. Preconditions for exploitation: The attacker must (a) possess valid authentication credentials from an external directory or AAA service that the device trusts, and (b) be able to influence the username or profile identifier associated with their account so that it contains shell metacharacters. In environments where the directory allows self-service profile fields (e.g., a display name or profile identifier used in the authentication path) or where the attacker has write access to their own directory entry, this is achievable without additional privilege.

3. Trigger (vulnerability-class mechanism): The attacker authenticates to the device via SSH using their external-directory credentials and then terminates the session. On session close, the PAM session cleanup routine constructs and executes a privileged shell command that incorporates the username/profile identifier. Because shell metacharacters in that identifier are not neutralized (CWE-78), the shell executes attacker-injected commands as root. No specific function names, file paths, or API endpoints are disclosed in the available data, so the exact command construction cannot be described without fabrication.

4. Post-exploitation impact: Successful injection yields arbitrary command execution as root on the Fabric OS device. Fabric OS switches manage Fibre Channel SAN fabrics — an attacker with root access could read or alter zoning configurations, obtain credentials or fabric secrets, disrupt or redirect storage traffic, disable fabric services (impacting availability of storage for downstream hosts), or use the device as a pivot into the management network. Because execution occurs at session teardown, the activity may not be visible in interactive session logs.

Impact Assessment

The impact is high across all three CVSS impact metrics (Confidentiality, Integrity, Availability), with a Scope Changed (S:C) designation because the PAM cleanup component executes with privileges that extend beyond the scope of the authenticated user's intended authorization.

• Confidentiality (High): Root-level access on a SAN switch exposes fabric configuration, zoning data, credentials, and potentially data traversing connected storage paths.
• Integrity (High): An attacker can modify zoning, fabric parameters, or device configuration, potentially redirecting or corrupting storage access.
• Availability (High): SAN switches are critical single points of failure in storage fabrics; disabling or misconfiguring one can cause storage outages across many downstream servers.
• Blast radius: Affected environments are those running Brocade Fabric OS before 9.2.2d or 10.0.0 through 10.0.0a1 with external/AAA authentication enabled. In large enterprises and data centers, a compromised SAN switch can affect dozens to hundreds of attached hosts and storage arrays. The EPSS score of 0.02650 (85.2nd percentile) indicates a moderate but non-trivial likelihood of exploitation relative to all tracked CVEs. There is no evidence of CISA KEV listing or in-the-wild exploitation in the provided data.

Detection Guidance

Sigma Rule

title: Brocade Fabric OS PAM Session Cleanup Command Injection via SSH Termination
id: 8f3a2c1e-4b7d-4c9a-9e21-0d5f6a7b8c90
status: experimental
description: Detects shell metacharacters in usernames or profile identifiers associated with SSH session termination on Brocade Fabric OS devices, consistent with CVE-2026-94579 PAM cleanup command injection.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-94579
author: valtersit.com
date: 2026/01/01
logsource:
  product: brocade
  service: fabric_os
detection:
  selection_session:
    message|contains:
      - 'pam_close_session'
      - 'session cleanup'
      - 'SSH session closed'
  selection_meta:
    message|contains:
      - ';'
      - '|'
      - '`'
      - '$('
      - '&&'
      - '>'
  condition: selection_session and selection_meta
fields:
  - user
  - src_ip
  - command
falsepositives:
  - Legitimate usernames containing unusual characters (rare)
level: high

YARA Rule

rule CVE_2026_94579_Brocade_PAM_CmdInjection
{
    meta:
        description = "Detects shell metacharacter patterns in authentication/session-cleanup telemetry consistent with CVE-2026-94579"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-94579"
        date = "2026-01-01"
        severity = "high"

    strings:
        $pam1 = "pam_close_session" ascii nocase
        $pam2 = "session cleanup" ascii nocase
        $met1 = ";" ascii
        $met2 = "`" ascii
        $met3 = "$(" ascii
        $met4 = "&&" ascii
        $met5 = "|" ascii

    condition:
        (any of ($pam*)) and (2 of ($met*))
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $HOME_NET 22 (msg:"CVE-2026-94579 Brocade Fabric OS PAM Session Cleanup Command Injection Attempt"; flow:established,to_server; content:"SSH-"; depth:4; pcre:"/[\x3b\x60\x7c]|\$\(|&&/R"; threshold:type both, track by_src, count 5, seconds 60; classtype:attempted-admin; sid:202694579; rev:1; reference:cve,2026-94579; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

sequence by user.name, source.ip with maxspan=10m
  [authentication where event.action == "ssh_login" and event.outcome == "success"]
  [process where event.type == "start" and process.parent.name != null and
     process.args : ("*;*", "*`*", "*$(*", "*&&*", "*|*")]

Splunk SPL Query

index=network sourcetype=brocade:fabricos OR sourcetype=syslog
| search ("pam_close_session" OR "session cleanup" OR "SSH session closed")
| regex _raw="(;|\||`|\$\(|&&)"
| stats count min(_time) as first_seen max(_time) as last_seen values(user) as users values(src_ip) as src_ips by host
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="brocade,fabricos,cve-2026-94579,">
  <rule id="100579" level="12">
    <decoded_as>syslog</decoded_as>
    <match>pam_close_session|session cleanup|SSH session closed</match>
    <regex>(;|\||`|\$\(|&&)</regex>
    <description>CVE-2026-94579: Potential PAM session cleanup command injection on Brocade Fabric OS via SSH termination</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

The NVD description states that affected versions are Brocade Fabric OS before 9.2.2d and 10.0.0 through 10.0.0a1. No vendor advisory, patch reference, or workaround was supplied in the source data, so the following recommendations are class-level controls rather than vendor-confirmed fixes.

1. Immediate mitigations (compensating controls):

   • Restrict SSH management access to the Fabric OS device to a dedicated, tightly controlled management network or out-of-band segment; block SSH from general user networks.
   • Enforce strict account naming policies in the external directory/AAA service: disallow shell metacharacters (;, |, `, $, (, ), &, >, <) in usernames and any profile identifier fields consumed by the device.
   • Restrict write access to directory attributes that feed authentication, so users cannot self-modify identifiers.
   • Where feasible, temporarily disable external/AAA authentication for Fabric OS management accounts and use local, tightly controlled accounts until a vendor fix is applied.
   • Monitor and alert on SSH session teardown events associated with usernames containing metacharacters (see Detection Guidance).

2. Patch/upgrade steps:

   • Contact Brocade/vendor support for the official advisory and fixed firmware. Per the NVD description, versions at or above 9.2.2d (and beyond the 10.0.0a1 range) are the corrected targets; verify the exact fixed release with the vendor before upgrading.
   • Stage firmware upgrades in a maintenance window. SAN fabric upgrades should follow vendor-recommended procedures (e.g., non-disruptive upgrade paths) to avoid fabric-wide outages.
   • After upgrade, re-validate that external/AAA authentication behaves correctly and re-test session teardown.

3. Long-term hardening:

   • Adopt a vulnerability management process that tracks Brocade Fabric OS advisories and maps SAN switches into the enterprise asset inventory with firmware version tracking.
   • Apply least privilege to directory service accounts and profile attributes; regularly audit for identifiers containing unusual characters.
   • Implement network segmentation for storage management planes and monitor them with the detection rules above.
   • Require change control and monitoring for zoning and fabric configuration changes, since root-level compromise of a switch can silently alter storage access paths.

References

• NVD — CVE-2026-94579: https://nvd.nist.gov/vuln/detail/CVE-2026-94579
• MITRE CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): https://cwe.mitre.org/data/definitions/78.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Brocade (Broadcom) Fabric OS security advisories portal: https://www.broadcom.com/support/fibre-channel-networking/security-advisories
• EPSS — CVE-2026-94579 score page: https://api.first.org/data/v1/epss?cve=CVE-2026-94579

No public PoC, exploit code, Nuclei template, or CISA KEV entry was identified in the provided data. No threat actor campaign or exploit-in-the-wild evidence is available.