Arbitrary File and Directory Deletion in Brocade Fabric OS by Broadcom
CVE-2026-94580

5.7MEDIUM

Key Information:

Vendor

Brocade
Status
Fabric Os
Vendor
CVE Published:
8 October 2026

What is CVE-2026-94580?

An arbitrary file and directory deletion vulnerability in the REST API management interface allows authenticated users with USB management privileges to manipulate target paths, resulting in the potential removal of files or directories from the switch's local root filesystem. This action can occur without adhering to the designated USB mount point restrictions, posing significant security risks.

Affected Version(s)

Fabric OS 0 < 10.0.1

References

https://support.broadcom.com/external/content/SecurityAdv...

CVSS V4

Score:
5.7
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.