CVE-2026-94583 — A race condition vulnerability exists in the request processing logic of the REST management interface on Brocade Fabric OS versions before 10.0.1.
Description
A race condition vulnerability exists in the request processing logic of the REST management interface on Brocade Fabric OS versions before 10.0.1. When handling concurrent incoming network management FCIP requests, a timing window exists between when a request populates the address variable and when the service constructs and returns the response context. As a result, the first request adopts the modified context, causing the service to return sensitive management details or configuration data belonging to the second context back to the original requester.
CVSS v4.0 base metrics
CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XLow severity
Band computed from the CVSS base score, not the source's own label — so it means the same thing across every feed.
AV
Adjacent
Attack Vector
AC
High
Attack Complexity
AT
None
Attack Requirements
PR
Low
Privileges Required
UI
None
User Interaction
VC
Low
Confidentiality (Vulnerable System)
VI
None
Integrity (Vulnerable System)
VA
None
Availability (Vulnerable System)
SC
None
Confidentiality (Subsequent System)
SI
None
Integrity (Subsequent System)
SA
None
Availability (Subsequent System)
References
Related threats
same CWE or vendorCVE-2026-84271 — IBM Guardium Data Protection 12.2 is vulnerable to a signature verification bypass in the patch installer.
CVE-2026-84271 · 2h ago
CVE-2026-42698 — Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Themeum Tutor LMS tutor allows Leverag…
CVE-2026-42698 · 8h ago
CVE-2026-94584 — A race condition and thread-safety vulnerability exists in the web management daemon of Brocade Fabric OS versions before 10.0.1.
CVE-2026-94584 · 18h ago
CVE-2026-107276 — MISP contains a race condition in the email-based one-time password (OTP) login flow.
CVE-2026-107276 · 1d ago
CVE-2026-105140 — Obot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 contains a race condition in auth provider group refreshes that can restore group memberships ju…
CVE-2026-105140 · 1d ago
CVE-2026-106500 — Backstage is an open framework for building developer portals.
CVE-2026-106500 · 2d ago