CVE-2026-94576: broadcom fabric_operating_system Partial String Comparison

Vulnerability summary

CVE-2026-94576 is a high (CVSS 8.0) Partial String Comparison vulnerability in broadcom fabric_operating_system. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 36.5% of scored vulnerabilities.

Timeline

1. 08-10-2026
   PublishedVulnerability first disclosed.
2. 08-10-2026
   Last modifiedVulnerability information updated.

Description

An authentication logic and privilege escalation vulnerability exists in the account management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. Under specific conditions, an authenticated user can bypass authorization restrictions intended to prevent modifying another account's access privileges. Exploitation allows a lower-privileged user to assign administrative roles to a target account, leading to localized privilege escalation.

• CWE-187Partial String ComparisonThe product performs a comparison that only examines a portion of a factor before determining whether there is a match, such as a substring, leading to resultant weaknesses.