CVE-2026-94580: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Brocade Fabric OS

CVE-2026-94580 describes a vulnerability in Brocade Fabric OS's REST API management interface handling USB storage operations. Specifically, the flaw allows an authenticated user with USB management privileges to craft requests that manipulate target paths, enabling deletion of arbitrary files or directories on the local root filesystem. This bypasses the intended boundary restrictions that should confine deletions to the USB mount point. The vulnerability affects versions prior to 10.0.1.

The vulnerability allows privileged authenticated users to delete arbitrary files and directories on the device's root filesystem, potentially disrupting device operation or causing denial of service. The impact is limited to users with USB management privileges and requires authentication. There is no indication of remote unauthenticated exploitation or privilege escalation beyond the USB management role.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the affected versions are prior to 10.0.1, upgrading to version 10.0.1 or later may address the issue if confirmed by the vendor. Until a patch is confirmed, restrict USB management privileges to trusted administrators and monitor for suspicious activity related to USB storage operations.