CVE-2026-94580 in Fabric OS
Summary
by MITRE • 10/08/2026
An arbitrary file and directory deletion vulnerability exists in the REST API management interface handling USB storage operations on Brocade Fabric OS versions before 10.0.1. An authenticated user possessing USB management privileges can manipulate requested target paths to delete arbitrary files or directories on the switch's local root filesystem, bypassing intended USB mount point boundaries.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified in Brocade Fabric Operating System prior to version 10.0.1 represents a critical security flaw within the REST API management interface responsible for handling USB storage operations. This issue stems from an arbitrary file and directory deletion capability that allows authenticated users with specific USB management privileges to manipulate target paths during delete requests. The core technical failure lies in insufficient input validation regarding path traversal sequences, which enables attackers to bypass intended boundaries associated with mounted USB devices. By injecting relative or absolute path components into the request parameters, a malicious actor can direct the system's file deletion routines toward arbitrary locations on the switch’s local root filesystem rather than restricting operations strictly within the designated USB mount point directory structure.
From an operational perspective, this vulnerability poses severe risks to network infrastructure stability and integrity. An attacker exploiting this flaw could delete critical configuration files, logs, or binary executables located in system directories such as /etc, /var, or /bin. The deletion of essential operating system components can lead to service disruptions, complete loss of management functionality, or a denial-of-service condition where the switch becomes unresponsive and requires manual intervention for recovery. Furthermore, if sensitive configuration files containing credentials or network topology data are removed, it may force re-authentication cycles that disrupt ongoing fabric operations or expose the environment to further compromise during restoration efforts.
This vulnerability aligns with Common Weakness Enumeration (CWE) category CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal. The exploitation mechanism also corresponds to MITRE ATT&CK technique T1070.006: Indicator Removal on Host via File Deletion, which describes the removal of artifacts or tools used during an intrusion. In this context, while the immediate action is deletion rather than hiding evidence, the capability to erase arbitrary files serves as a potent tool for disrupting availability and potentially covering tracks after other malicious activities have occurred within the management plane.
Mitigation strategies primarily involve upgrading Brocade Fabric OS to version 10.0.1 or later, where this path validation logic has been corrected to enforce strict boundary checks on all file system operations initiated through the USB management API. Until an upgrade is feasible, administrators should restrict access to the REST API interface by implementing network-level controls such as firewall rules that limit connectivity to trusted management stations only. Additionally, enforcing role-based access control (RBAC) policies ensures that USB management privileges are granted exclusively to a minimal set of authorized personnel who require them for legitimate operational tasks, thereby reducing the attack surface available to potential insiders or compromised accounts with elevated permissions.