CVE-2026-94584 in Fabric OS
Summary
by MITRE • 10/08/2026
A race condition and thread-safety vulnerability exists in the web management daemon of Brocade Fabric OS versions before 10.0.1. When handling user authentication requests across a multi-threaded execution pool, this race condition causes PAM modules to process stale or incorrect client IP addresses and switch context numbers. This leads to inaccurate audit records and potential access control bypasses where AAA evaluation or Calling-Station-ID ACL policies rely on client IP attributes.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/09/2026
The vulnerability identified in Brocade Fabric OS versions prior to 10.0.1 represents a critical flaw within the web management daemon, specifically stemming from inadequate synchronization mechanisms during multi-threaded authentication processing. This race condition arises when multiple threads concurrently handle user authentication requests without proper locking or atomic operations on shared state variables associated with Per-Authentication Module (PAM) contexts. In a typical secure implementation, each thread handling an authentication request must maintain isolated context data to ensure that attributes such as the client IP address and switch context number are correctly bound to the specific session being authenticated. However, due to this concurrency defect, threads may inadvertently access or overwrite shared memory locations intended for other concurrent sessions. This lack of thread safety results in PAM modules processing stale or incorrect client IP addresses and switching contexts between different users during the authentication handshake process.
The operational impact of this vulnerability is significant because it directly compromises the integrity of audit logging and the reliability of network access control policies. When the system processes a request with an incorrect client IP address, the resulting audit records become inaccurate, making forensic analysis and compliance reporting unreliable for security operations teams who depend on these logs to track administrative actions or detect anomalies. More critically, this flaw can lead to potential access control bypasses in environments where authentication, authorization, and accounting (AAA) systems rely heavily on dynamic attributes like Calling-Station-ID ACL policies. If an attacker can manipulate the race condition to cause a thread to inherit the context of another user, they might exploit misattributed IP addresses or switch contexts to gain unauthorized access to network resources that should be restricted based on their actual identity or location. This undermines the fundamental principle of least privilege and could allow lateral movement within the data center fabric if an attacker successfully exploits this condition to impersonate a privileged administrator or bypass segment isolation controls.
From a classification perspective, this vulnerability aligns with CWE-362, which describes concurrent execution using shared resources with improper synchronization, leading to race conditions. The ability to manipulate authentication context and potentially bypass access control mechanisms also maps to MITRE ATT&CK techniques related to privilege escalation and credential manipulation, specifically those involving the exploitation of software vulnerabilities during login processes. Security professionals must recognize that this is not merely a logging error but a fundamental breakdown in session isolation within the management plane, which serves as the primary interface for network configuration and monitoring.
To mitigate this risk, organizations running Brocade Fabric OS versions before 10.0.1 should prioritize applying the vendor-provided patch immediately upon availability. Until the update is applied, administrators should restrict access to the web management interface by implementing strict IP-based firewall rules that limit connectivity only to trusted administrative workstations and jump hosts. Additionally, enabling enhanced logging verbosity can help in detecting unusual patterns of authentication failures or context switches, although this does not prevent exploitation. It is also advisable to review AAA policies for any reliance on Calling-Station-ID attributes derived from the web management daemon's IP attribution logic, as these may currently be unreliable due to the race condition. Regular audits of audit logs should include checks for inconsistencies in client IP addresses associated with administrative actions, serving as a potential indicator of exploitation attempts or system instability caused by this flaw.