CVE-2026-94575: CWE-483: Incorrect Block Delimitation in Brocade Fabric OS

CVE-2026-94575 describes a logic vulnerability in Brocade Fabric OS web management framework versions prior to 10.0.1. This flaw permits an authenticated, low-privileged user to bypass inner RBAC checks under specific environmental conditions. Successful exploitation results in the active session's authorization mode being lowered, enabling access to restricted administrative configuration settings. The vulnerability is categorized under CWE-483 (Incorrect Block Delimitation). No known exploits are reported in the wild, and no official patch information is provided in the input data.

An attacker with valid low-level credentials can escalate their access within the web management framework by bypassing RBAC controls. This leads to unauthorized access to sensitive configuration settings intended only for administrative roles, potentially compromising system integrity and management.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the web management interface to trusted users only and monitor for suspicious activity involving privilege escalation attempts.