Brocade Fabric OS
At a glance
- Source
- NVD
- EPSS
- EPSS 0.11 % · percentile 1 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- brocade
- NVD status
- Analyzed
Description
An improper file permission and missing authorization vulnerability exists in the diagnostic kernel module subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An unprivileged local user can invoke privileged hardware tests, force system error conditions, reset hardware blades, or disrupt storage fabric operations.
Weaknesses (CWE)
- CWE-732 — Incorrect Permission Assignment for Critical Resource
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 4.0 | HIGH 7.0 | CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N | brocade |
| CVSS 4.0 | HIGH 7.0 | CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD · sirt@brocade.com (Secondary) |
| CVSS 3.1 | HIGH 7.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2026-94697
- GCVE · GCVE-0-2026-87660
Affected configurations (NVD CPE)
cpe:2.3:o:broadcom:fabric_operating_system:*:*:*:*:*:*:*:*< 9.2.2dcpe:2.3:o:broadcom:fabric_operating_system:*:*:*:*:*:*:*:*≥ 10.0.0 < 10.0.1
Affected products
| Product | Versions |
|---|---|
| Brocade · Fabric OS | affected 0 < 9.2.2d ; affected 10.0.0 ≤ 10.0.0a1 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |