CVE-2026-94583: Brocade Fabric OS

Low severity, CVSS 2.1. EPSS: 0.1% chance of exploitation in the next 30 days.

A race condition vulnerability exists in the request processing logic of the REST management interface on Brocade Fabric OS versions before 10.0.1. When handling concurrent incoming network management FCIP requests, a timing window exists between when a request populates the address variable and when the service constructs and returns the response context. As a result, the first request adopts the modified context, causing the service to return sensitive management details or configuration data belonging to the second context back to the original requester.

Affected products

• Brocade Fabric OS: before 10.0.1 (fixed in 10.0.1)

Published 2026-10-08. Last modified 2026-10-08.