VDB
CVE-2026-94579
CVE-2026-94579
PUBLISHED
CVSS 5.4 MEDIUM
Reported by brocade · Published October 8, 2026
An OS command injection vulnerability exists in the PAM (Pluggable Authentication Module) session cleanup routines during SSH session termination on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user authenticating via an external directory or AAA service whose username or profile identifier contains shell metacharacters can trigger arbitrary command execution with root privileges when their remote SSH session closes.
Risk Scores
CVSS 4.0
5.4
CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Brocade | Fabric OS | 0, 10.0.0 |
| Brocade | Fabric OS | 0, 10.0.0 |
Timeline
- Oct 8, 2026 EPSS Score
- Oct 8, 2026 Coalition ESS Score
- Oct 8, 2026 CVE Published
- Oct 14, 2026 EPSS Score
- Oct 14, 2026 CVE Updated
- Oct 15, 2026 EPSS Score