CVE-2026-94580: Path Traversal
An arbitrary file and directory deletion vulnerability exists in the REST API management interface handling USB storage operations on Brocade Fabric OS versions before 10.0.1. An authenticated user possessing USB management privileges can manipulate requested target paths to delete arbitrary files or directories on the switch's local root filesystem, bypassing intended USB mount point boundaries.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Brocade Fabric OSto a version that resolves this vulnerability.Fixed in 10.0.1
Event History
Frequently Asked Questions
What level of access does an attacker need?
Exploitation requires an authenticated user with USB management privileges who can access the REST API management interface. The CVSS vector also classifies the attack vector as adjacent and indicates that no user interaction is required.
Does exploitation require a victim to perform any action?
No. The CVSS vector specifies no user interaction, although it also indicates that attack requirements must be present.
What is the assessed security impact?
The CVSS assessment identifies high integrity impact, consistent with unauthorized deletion of files or directories. It identifies no direct confidentiality or availability impact.