CVE-2026-94584

Executive Summary

CVE-2026-94584 is a race condition and thread-safety vulnerability in the web management daemon of Brocade Fabric OS versions before 10.0.1. During multi-threaded authentication handling, PAM modules may process stale or incorrect client IP addresses and switch context numbers, producing inaccurate audit records and enabling potential access control bypasses where AAA evaluation or Calling-Station-ID ACL policies rely on client IP attributes. Organizations running unpatched Fabric OS management interfaces are affected.

Technical Analysis

The flaw is classified as CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ("Race Condition"). The vulnerable component is the web management daemon of Brocade Fabric OS, which serves administrative authentication requests and dispatches them across a multi-threaded execution pool. When concurrent authentication requests are processed, the PAM (Pluggable Authentication Module) stack can read client IP address and switch context number values that belong to a different, parallel request rather than the current one — a classic shared-state contamination pattern in which per-request context is stored in memory not properly scoped or synchronized per thread.

The NVD description identifies two distinct data elements affected by the race: the client IP address and the switch context number. Because PAM modules are invoked with these values, any downstream logic that depends on accurate client IP attribution becomes unreliable under concurrency. Two categories of control are explicitly called out as affected: (1) AAA (Authentication, Authorization, and Accounting) evaluation, and (2) Calling-Station-ID ACL policies. In both cases, the security decision is derived from the client IP attribute — meaning that if that attribute is stale or cross-contaminated, the authorization decision can be made against the wrong identity context. The accounting/audit record is additionally corrupted, undermining the forensic trail.

The attack surface is the web management daemon's authentication endpoint — network-reachable administrative interface. The vulnerability requires the ability to induce concurrent authentication traffic (a multi-threaded execution pool must be saturated such that context sharing occurs). No code-level function names, endpoints, or parameter names are provided in the available description; only the general mechanism is documented. No CVSS vector or score is available in the supplied data, and no CWE-adjacent exploit primitives (e.g., memory corruption) are implied — the impact is confined to logic/authorization integrity and audit integrity rather than code execution.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available; the attack chain below is inferred strictly from the vulnerability class (CWE-362) and the documented impact on AAA and Calling-Station-ID ACL evaluation.

1. Reconnaissance / target identification. An attacker identifies a Brocade Fabric OS web management daemon, typically reachable on the management network, and confirms the version is below 10.0.1 via banner, UI, or management response. Management interfaces are often reachable from administrative VLANs, jump hosts, or — in misconfigured deployments — broader network segments.

2. Triggering the race condition. The attacker issues a high volume of concurrent authentication requests to the web management daemon's authentication path. Because the daemon dispatches these across a multi-threaded execution pool, the per-request client IP address and switch context number handled by the PAM modules can be overwritten or read from stale state belonging to another in-flight request. The attacker does not need any special primitive beyond the ability to generate parallel authentication attempts against the exposed interface.

3. Payload / execution method (vulnerability-class level). The "payload" is concurrency itself: parallel requests that cause the PAM layer to evaluate one session using another session's client IP address / context number. When the attacker's request is evaluated against a client IP attribute belonging to a trusted or differently-scoped station, AAA evaluation or a Calling-Station-ID ACL policy can resolve in the attacker's favor — an access control bypass driven by attribute corruption rather than credential compromise.

4. Post-exploitation impact. Successful bypass grants the attacker an authenticated/authorized management session context they should not have obtained, or causes policy to be applied against the wrong station identity. Simultaneously, audit and accounting records generated by PAM describe the wrong client IP and context, degrading or defeating attribution. There is no evidence in the provided data of remote code execution, credential dumping, or lateral movement primitives; the documented impact is authorization bypass plus audit integrity loss.

Impact Assessment

No CVSS score or vector was supplied by the CNA/NVD for this CVE, so impact must be reasoned qualitatively from the description. The confidentiality, integrity, and availability of the fabric management plane are all implicated to varying degrees: confidentiality via potential access to management functions gated by AAA, integrity via corrupted audit/accounting trails and incorrect policy decisions, and availability indirectly through unauthorized administrative action. The attack requires network access to the management daemon and the ability to generate concurrent authentication traffic, but no authentication is needed to trigger the race. Blast radius is bounded per-device but high in severity for environments that rely on Calling-Station-ID ACLs or client-IP-based AAA as a security boundary — a bypass invalidates that boundary. Because audit records may be wrong, incident responders may not be able to reliably identify which station performed an action, extending the detection and containment timeline.

Detection Guidance

Sigma Rule

title: Concurrent Authentication Burst Against Brocade Fabric OS Web Management Daemon
id: 8b1f7c2e-4a6d-4e2a-9c3f-1d7b5e9a0f21
status: experimental
description: Detects high-volume concurrent authentication attempts against the Brocade Fabric OS web management daemon, consistent with attempts to trigger a PAM context race condition (CVE-2026-94584).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-94584
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1190
  - cve.2026-94584
logsource:
  category: web
  product: brocade
detection:
  selection:
    cs-uri-stem|contains:
      - '/login'
  timeframe: 30s
  condition: selection | count() by src_ip > 25
fields:
  - src_ip
  - cs-uri-stem
  - sc-status
falsepositives:
  - Legitimate automated management tooling or monitoring systems authenticating in bursts
  - Load balancer health checks that hit the authentication path
level: medium

YARA Rule

rule CVE_2026_94584_BrocadeFabricOS_AuthRace
{
    meta:
        description = "Detects Brocade Fabric OS web management daemon builds predating 10.0.1 referenced alongside CVE-2026-94584 artifacts"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-94584"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $banner1 = "Fabric OS"
        $ver1    = "10.0.0" ascii
        $mgmt1   = "web management daemon" nocase
        $pam1    = "Calling-Station-ID" nocase
        $pam2    = "PAM" ascii

    condition:
        uint16(0) == 0x5A4D and
        ( $banner1 or $mgmt1 ) and
        ( $ver1 or $pam1 or $pam2 )
}

Suricata IDS Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET [80,443] (msg:"CVE-2026-94584 Brocade Fabric OS web management daemon concurrent auth burst (possible PAM race)"; flow:to_server,established; content:"POST"; http_method; content:"/login"; http_uri; nocase; threshold:type both, track by_src, count 25, seconds 30; classtype:attempted-user; reference:cve,2026-94584; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-94584; sid:202694584; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where network.protocol == "http" and url.path : "/login" ] with runs=25

Splunk SPL Query

index=web sourcetype=brocade:mgmt
| search uri_path="/login" method=POST
| bin _time span=30s
| stats count by src_ip, _time
| where count > 25
| table _time, src_ip, count

Wazuh OSSEC Rule

<group name="brocade,fabricos,web,">
  <rule id="100945" level="10">
    <if_sid>31100</if_sid>
    <match>Fabric OS</match>
    <regex>\/login</regex>
    <description>CVE-2026-94584: Possible concurrent authentication burst against Brocade Fabric OS web management daemon (PAM race condition)</description>
    <group>cve_2026_94584,authentication_failures,</group>
  </rule>
  <rule id="100946" level="12" frequency="25" timeframe="30">
    <if_matched_sid>100945</if_matched_sid>
    <same_source_ip />
    <description>CVE-2026-94584: Sustained concurrent auth attempts from same source - likely race condition exploitation attempt</description>
    <group>cve_2026_94584,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations. Restrict network reachability of the Brocade Fabric OS web management daemon to a dedicated, tightly controlled management VLAN or jump host, and enforce network-layer access control so untrusted hosts cannot generate concurrent authentication requests against it. Where feasible, disable the web management daemon and use out-of-band management. Monitor authentication concurrency per source (see Detection Guidance) to identify race-triggering bursts. Do not treat client-IP-based AAA or Calling-Station-ID ACLs as a reliable authorization boundary on affected versions.

2. Patch / upgrade steps. The NVD description states the flaw is addressed in Brocade Fabric OS 10.0.1. Upgrade any Fabric OS deployment running a version below 10.0.1 to 10.0.1 or later, following Brocade's documented upgrade path and validating fabric stability after the change. No vendor fix reference, workaround, or advisory URL was present in the tracked sources for this CVE, so confirm the fixed release and any interim guidance directly through Brocade support before scheduling the upgrade.

3. Long-term hardening. Eliminate reliance on client IP attributes as primary authorization inputs for management access; prefer strong per-session authentication (certificate-based or MFA-backed) where supported. Enforce strict management-plane segmentation and centralized, tamper-resistant logging so that corrupted on-device audit records can be correlated against independent network telemetry. Track Brocade Fabric OS security advisories and subscribe to vendor notification channels to close the gap created by the absence of patch evidence in general CVE feeds.

References

• NVD — CVE-2026-94584: https://nvd.nist.gov/vuln/detail/CVE-2026-94584
• CWE-362 — Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'): https://cwe.mitre.org/data/definitions/362.html
• Brocade Fabric OS product/security documentation and advisories (consult via Broadcom/Brocade support portal for the 10.0.1 fix confirmation)
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• FIRST EPSS — CVE-2026-94584 score context (EPSS 0.00146, ~3.3rd percentile): https://www.first.org/epss/

No threat actor campaign, exploit-in-the-wild evidence, public PoC, or CISA KEV listing was identified for CVE-2026-94584 in the supplied intelligence data.