CVE-2026-94585 in Fabric OS
Summary
by MITRE • 10/08/2026
An authentication bypass vulnerability exists in the web management interface of Brocade Fabric OS versions before 9.2.2d running on the MXG610 platform. An unauthenticated, network-adjacent attacker can exploit an unauthenticated endpoint within the Single Sign-On (SSO) workflow to gain administrative access to the device management interface.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified in Brocade Fabric OS versions prior to 9.2.2d on the MXG610 platform represents a critical authentication bypass flaw within the web-based management interface. This security defect specifically targets the Single Sign-On workflow, which is designed to streamline access by allowing users to authenticate once and gain entry to multiple services without re-entering credentials. The core technical failure lies in an unauthenticated endpoint that fails to properly enforce session validation or token verification during the SSO process. Consequently, an attacker who can reach this specific network path does not need valid user credentials to interact with the administrative functions of the device management interface. This architectural weakness effectively nullifies the intended security controls provided by the authentication mechanism, allowing direct access to privileged commands and configuration settings without any form of identity verification.
From a technical perspective, the flaw stems from improper validation logic within the SSO implementation. When an unauthenticated request is directed at this specific endpoint, the system incorrectly assumes that the user has already passed through the initial authentication gate or fails to check for the presence of valid session tokens before granting access. This misconfiguration allows network-adjacent attackers to bypass the login screen entirely and execute administrative commands as if they were authorized administrators. The impact is severe because Brocade Fabric OS manages critical storage area network infrastructure, including switch configurations, zoning policies, and fabric topology settings. Unauthorized access enables an attacker to disrupt service availability by reconfiguring zones or shutting down ports, exfiltrate sensitive data stored on connected arrays by altering security permissions, or install persistent backdoors for long-term lateral movement within the enterprise network.
This vulnerability aligns with CWE-287, which describes Improper Authentication, as well as CWE-306, Missing Authentication for Critical Function, since the specific endpoint lacks adequate access control checks. In terms of offensive security frameworks such as MITRE ATT&CK, this exploit maps to T1078 Valid Accounts and specifically leverages techniques related to Initial Access through exploited vulnerabilities in network services. The ability to gain administrative access without credentials also touches upon privilege escalation concepts if the default configuration grants broad permissions to unauthenticated sessions on that specific interface path.
Mitigation strategies must prioritize immediate patching of all affected Brocade Fabric OS installations to version 9.2.2d or later, where this endpoint validation logic has been corrected by Broadcom. Until patches are applied, network administrators should implement strict access control lists at the firewall level to restrict traffic to the management interface exclusively from trusted administrative subnets. Additionally, disabling unnecessary services and endpoints that do not require external accessibility can reduce the attack surface. Regular auditing of authentication logs for anomalous login patterns or unexpected session creations may help in detecting potential exploitation attempts before significant damage occurs. Ensuring that all network devices are kept up to date with vendor-recommended security fixes remains the most effective defense against such critical infrastructure vulnerabilities.