CVE-2026-94584: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in Brocade Fabric OS

CVE-2026-94584 describes a race condition and thread-safety vulnerability in the web management daemon of Brocade Fabric OS versions prior to 10.0.1. When handling user authentication requests concurrently, the vulnerability causes PAM modules to handle stale or incorrect client IP addresses and switch context numbers improperly. This results in inaccurate audit logging and may allow bypass of access control mechanisms such as AAA evaluation or Calling-Station-ID ACL policies that depend on client IP information.

The vulnerability can lead to inaccurate audit records, which may hinder forensic analysis and monitoring. More critically, it can cause access control bypasses in environments where authentication and authorization policies depend on client IP attributes, potentially allowing unauthorized access or privilege escalation under certain conditions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided at this time. Until a patch is available, organizations should review their use of client IP-dependent access control policies and consider additional compensating controls to mitigate risk.