CVE-2026-94585

Executive Summary

CVE-2026-94585 is an authentication bypass vulnerability in the web management interface of Brocade Fabric OS versions prior to 9.2.2d running on the MXG610 hardware platform. An unauthenticated, network-adjacent attacker can abuse an endpoint within the Single Sign-On (SSO) workflow that does not perform authentication, granting them administrative access to the device management interface. Successful exploitation yields full administrative control of the affected SAN switch, exposing storage fabric configuration, zoning data, and management credentials.

Technical Analysis

The vulnerability is classified as CWE-288: Authentication Bypass Using an Alternate Path or Channel. This weakness class describes a situation where a product implements an authentication mechanism, but a secondary access path — a different endpoint, code branch, protocol path, or request method — reaches protected functionality without enforcing that authentication.

In this case, the alternate channel is located within the Single Sign-On (SSO) workflow of the Fabric OS web management interface. SSO workflows typically introduce several distinct request paths: an identity-provider redirect, a token assertion or callback endpoint, and a session-establishment handler. Any of these endpoints that processes inbound requests before a validated session or assertion exists becomes a candidate for an alternate-path bypass. The NVD description states that an unauthenticated endpoint within this workflow is exploitable, which indicates that the endpoint accepts and acts on requests from an unauthenticated caller rather than rejecting or redirecting them.

The key characteristics:

• Pre-authentication reachability. Exploitation requires no valid credentials, no prior session, and no user interaction on the target. The attacker interacts directly with the exposed endpoint.
• Network-adjacent positioning. The attacker must be able to reach the device's web management interface over the network. This is an adjacent (AV:A) access vector in CVSS terms — the attacker is on the same network segment or a network path that can reach the management interface, rather than requiring internet-wide exposure.
• Administrative outcome. The bypass does not merely expose read-only data. Successful exploitation results in administrative access to the device management interface, meaning the attacker obtains the full privilege set of an administrative operator.
• Platform specificity. The vulnerability applies to Fabric OS before 9.2.2d on the MXG610 platform. Fabric OS is shared across multiple Brocade switch families, so the affected population is bounded by both the version ceiling and the hardware platform.

The root-cause pattern — a workflow introduced to simplify or federate authentication that itself lacks an authentication gate — is a well-documented class of defect. SSO implementations frequently trust the identity provider to perform validation and therefore omit validation on the service-provider side. When an endpoint in that chain is exposed without that trust relationship being properly established or verified, the result is precisely the alternate-path bypass described here.

No CVSS vector, CNA title, or vendor advisory text was supplied alongside this CVE record. Accordingly, the CVSS vector in the metadata above is an inference from the described impact and access vector, not an official score. All statements about the internal implementation of the SSO workflow beyond "unauthenticated endpoint" are class-level reasoning; insufficient technical detail is available to name specific endpoints, parameters, tokens, or code paths, and none are invented here.

Exploitation Scenarios

The following attack chain is derived strictly from the vulnerability class and the facts stated in the NVD description. No public proof-of-concept, exploit code, or Nuclei template exists for this CVE. The steps below are therefore an inferred chain at the vulnerability-class level.

1. Reconnaissance and target identification. The attacker enumerates network-adjacent hosts for Brocade SAN switch management interfaces. The web management interface on the MXG610 platform is reachable over the network, so discovery can be performed with standard service scanning against HTTPS management ports and HTTP title/body fingerprinting for Brocade/Fabric OS management pages. The attacker confirms the target runs Fabric OS on MXG610 hardware and, ideally, that the version predates 9.2.2d. Because the attack is adjacent rather than remote-over-internet, reconnaissance is typically conducted from a host already positioned on the management network — a jump host, a compromised workstation in the same segment, or a misconfigured VLAN path.

2. Triggering the flaw class. The attacker sends a request directly to the unauthenticated SSO endpoint in the web management interface, without first authenticating and without presenting a valid SSO assertion. Because this endpoint occupies an alternate path in the authentication flow — separate from the normal login handler that does enforce authentication — it processes the request without validating that the caller has completed any authentication step. This is the essence of CWE-288: the primary path is protected, the alternate path is not.

3. Payload and execution at the class level. No crafted payload structure can be described here because the description does not disclose the endpoint's expected input format, token format, or parameters. At the vulnerability-class level, the attacker's request either establishes an administrative session directly or causes the device to issue authenticated session material (such as a session cookie or token) in response to an unauthenticated call. The attacker then reuses that material to access protected management functions. Any finer-grained description of the request body would require fabrication and is deliberately omitted.

4. Post-exploitation impact. With administrative access to the management interface, the attacker can read and modify the switch configuration, including zoning definitions, fabric membership, and management settings. Administrative access to a SAN switch permits changes that affect data availability for all hosts attached to the fabric, and Fabric OS management interfaces are conventionally a location where credentials for adjacent management systems and the fabric itself may be stored or configurable. Full integrity and confidentiality compromise of the device is the expected outcome, consistent with the CVSS impact subscores implied in the metadata vector (C:H/I:H/A:H).

Impact Assessment

Brocade SAN switches sit in the control plane of enterprise storage networks. An attacker who obtains administrative access to a fabric switch is positioned to alter zoning, remove or add fabric members, disrupt connectivity between hosts and storage arrays, and reconfigure management access — including potentially creating persistent administrative accounts or exfiltrating credentials visible from the management interface.

The affected population is bounded by two criteria: Fabric OS before 9.2.2d, and the MXG610 platform. Organizations that do not operate MXG610 hardware are not affected by this specific advisory, even if they run Fabric OS versions below 9.2.2d on other platforms. Organizations that do operate MXG610 switches below 9.2.2d must treat every such device as potentially compromised or vulnerable, particularly any device whose management interface is reachable from segments with lower trust.

Blast radius considerations:

• Confidentiality (High). Administrative access exposes full device configuration, including fabric topology, zoning, and any credentials or secrets stored in the management interface.
• Integrity (High). An administrator can modify zoning and fabric configuration, directly altering the behavior of the storage network.
• Availability (High). Misconfiguration or deliberate disruption of a SAN fabric switch can interrupt storage access, affecting every host and array that depends on the fabric.
• Scope. The access vector is adjacent (AV:A), which constrains internet-based mass exploitation. However, for a motivated attacker who has already achieved a foothold on the management network, the lack of any required privileges (PR:N) and lack of user interaction (UI:N) make this a low-friction escalation to full control of a critical network device.

The EPSS score of 0.00167 (5.4th percentile) indicates that, at the time of this assessment, the model estimates a low near-term likelihood of exploitation activity against this CVE across the exploited population. This is consistent with the absence of public exploit code, the absence of a Nuclei template, and the adjacent network access requirement. It should not be read as a statement that the vulnerability is low severity — the potential impact is administrative control of a SAN switch — only that broad opportunistic exploitation is not currently predicted. CISA KEV status is NO.

Detection Guidance

Sigma Rule

title: Suspicious Unauthenticated Access to Brocade Fabric OS SSO Endpoint
id: 8f1b6c2e-9458-5a2d-9c3a-ffb6f2a40e51
status: experimental
description: Detects requests to Brocade Fabric OS web management SSO workflow endpoints that do not carry a valid authenticated session, indicating potential exploitation of CVE-2026-94585.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-94585
author: valtersit.com Threat Intelligence
date: 2026/01/01
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026.94585
logsource:
  category: webserver
  product: brocade
  service: fabric_os_web
detection:
  selection_sso_path:
    cs-uri-stem|contains:
      - '/sso'
      - '/SSO'
      - '/saml'
      - '/oidc'
  selection_no_session:
    cs-cookie|contains: 'session'
    cs-cookie|exists: false
  selection_status:
    sc-status: 200
  condition: selection_sso_path and selection_no_session and selection_status
fields:
  - c-ip
  - cs-uri-stem
  - cs-method
  - sc-status
falsepositives:
  - Legitimate identity provider redirects that complete before session cookies are set
  - Load balancer health checks against SSO paths
level: high

YARA Rule

rule CVE_2026_94585_Brocade_FabricOS_SSO_AuthBypass_Indicators
{
    meta:
        description = "Heuristic detection for artifacts indicative of authentication bypass in Brocade Fabric OS SSO workflow (CVE-2026-94585). Matches log/web artifacts referencing unauthenticated SSO access on Fabric OS before 9.2.2d."
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-94585"
        date = "2026-01-01"
        cve = "CVE-2026-94585"
        confidence = "low"

    strings:
        $fabricos = "Fabric OS" ascii nocase
        $mxg = "MXG610" ascii nocase
        $sso = "SSO" ascii
        $unauth = "unauthenticated" ascii nocase
        $sso_path = "/sso" ascii nocase
        $admin = "administrative access" ascii nocase

    condition:
        filesize < 2MB and
        (
            ($fabricos and $sso and $sso_path) or
            ($mxg and $sso) or
            ($fabricos and $unauth and $admin)
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-94585 Brocade Fabric OS SSO Authentication Bypass Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/sso"; nocase; http.header; content:"Cookie"; negate; pcre:"/\/sso(\/|$|\?)/i"; classtype:attempted-admin; reference:cve,2026-94585; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-94585; metadata:created_at 2026_01_01, updated_at 2026_01_01; sid:90094585; rev:1;)

alert http any any -> any any (msg:"CVE-2026-94585 Brocade Fabric OS SSO Endpoint Access Without Session"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/sso"; nocase; http.header; content:"Cookie"; negate; classtype:attempted-admin; reference:cve,2026-94585; sid:90094586; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where network.protocol == "http"
      and url.path like~ ("*/sso*", "*/SSO*", "*/saml*", "*/oidc*")
      and not http.request.headers.cookie : "*session*" ]
  [ network where network.protocol == "http"
      and http.response.status_code == 200
      and url.path like~ ("*/sso*", "*/SSO*", "*/saml*", "*/oidc*") ]

Splunk SPL Query

index=web OR index=proxy sourcetype=access_combined
| where match(uri_path, "(?i)/(sso|saml|oidc)")
| eval has_session=if(isnull(cookie) OR NOT match(cookie, "(?i)session"), 0, 1)
| where has_session=0 AND status=200
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri_path, method, status, user_agent
| where count > 0
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="brocade,fabricos,web,">
  <rule id="945850" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <url>/sso|/SSO|/saml|/oidc</url>
    <regex>^(?:(?!session).)*$</regex>
    <description>CVE-2026-94585: Possible Brocade Fabric OS SSO authentication bypass attempt - unauthenticated access to SSO endpoint</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>authentication_bypass,attempted_admin,</group>
  </rule>

  <rule id="945851" level="14">
    <if_sid>945850</if_sid>
    <status>^200$</status>
    <description>CVE-2026-94585: SSO endpoint returned HTTP 200 without a session cookie - likely successful authentication bypass on Brocade Fabric OS</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>authentication_bypass,successful_admin,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence was available from any tracked source at the time of writing. The only remediation anchor provided is the version boundary stated in the NVD description.

1. Immediate mitigations

   • Restrict network access to the web management interface of all MXG610 devices. Place management interfaces on a dedicated, isolated management VLAN or out-of-band management network that is not reachable from user workstations or general-purpose server segments. Because the exploit requires adjacent network access, removing reachability is the most effective compensating control while no patch is available.
   • Enforce firewall ACLs in front of the management interface that permit access only from explicitly authorized administrative jump hosts.
   • Disable the web management interface on affected devices if operational requirements permit, and rely on the CLI over a restricted management network instead.
   • Where the SSO workflow is not operationally required, disable it. Reducing the exposed feature surface removes the alternate-path endpoint identified by the vulnerability.
   • Monitor authentication and web access logs on MXG610 devices and on network devices in front of them for requests to SSO-related paths that arrive without session cookies, per the detection guidance above.

2. Patch / upgrade steps

   • Upgrade affected MXG610 devices to Brocade Fabric OS 9.2.2d or later. The NVD description identifies versions "before 9.2.2d" as affected, making 9.2.2d the minimum fixed version for this platform.
   • Because no vendor advisory, CVE identifier in a vendor bulletin, or patch confirmation was retrievable from tracked sources, validate the fix directly with the vendor before relying on it: confirm with Brocade (Broadcom) support that 9.2.2d contains the fix for CVE-2026-94585 on MXG610, and request the associated release notes.
   • Follow the standard Fabric OS upgrade procedure, including configuration backup, fabric-wide compatibility checks, and a maintenance window, since SAN switch upgrades can affect fabric availability.

3. Long-term hardening

   • Adopt a network architecture in which SAN switch management planes are never reachable from general-purpose networks, which neutralizes this class of adjacent-network authentication bypass regardless of software state.
   • Implement centralized authentication (for example, RADIUS or TACACS+) with strong authentication for administrative access, and audit administrative account creation on a schedule.
   • Maintain an inventory that maps Fabric OS versions to hardware platforms, so that platform-specific advisories such as this one can be triaged precisely.
   • Subscribe to vendor security bulletins for Brocade Fabric OS and track advisories by platform capability, not by version range alone.
   • Log and alert on all administrative configuration changes on fabric switches, so that post-exploitation modification of zoning or fabric membership is detectable even if initial access is not blocked.

References

1. NVD — CVE-2026-94585: https://nvd.nist.gov/vuln/detail/CVE-2026-94585
2. MITRE CWE-288 — Authentication Bypass Using an Alternate Path or Channel: https://cwe.mitre.org/data/definitions/288.html
3. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
4. Broadcom/Brocade Fabric OS Security Advisories (vendor bulletin portal for Fabric OS release and security notifications): https://www.broadcom.com/support/fibre-channel-networking/security-advisories
5. FIRST EPSS — CVE-2026-94585 score lookup: https://api.first.org/data/v1/epss?cve=CVE-2026-94585

Threat actor campaign and exploit-in-the-wild evidence: none identified in the available data. CISA KEV status is NO, no public proof-of-concept or exploit code exists, and no Nuclei template was found. All exploitation guidance in this report is inferred from the vulnerability class (CWE-288) and the facts stated in the NVD description, and should be validated against the vendor's release notes before operational use.