Skip to content
Heist/ feed
Medium

CVE-2026-94580

Type: advisorySource: Official CVE List1 source record

An arbitrary file and directory deletion vulnerability exists in the REST API management interface handling USB storage operations on Brocade Fabric OS versions before 10.0.1. An authenticated user possessing USB management privileges can manipulate requested target paths to delete arbitrary files or directories on the switch's local root filesystem, bypassing intended USB mount point boundaries.

Announced Source revision 1
Original source ↗

CVE-2026-94580

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-94580

Fabric OS

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "vendor": "Brocade",
    "product": "Fabric OS",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "10.0.1",
        "versionType": "Brocade FabricOS"
      }
    ],
    "defaultStatus": "unaffected"
  }
]
Related CVEs
CVE-2026-94580

Source reference: /cveMetadata/cveId

Publisher severity

medium

Source reference: /containers/cna/metrics

Event
#12973 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement