Brocade Fabric OS accepts raw Apache configuration data during service setup or reinitialization. If an attacker corrupts that configuration structure, the web management service fails to start or cannot recover during a bring‑up cycle, resulting in a persistent loss of access to the administrative web interface. This weakness is a CWE‑93 vulnerability.

Fabric OS versions earlier than 9.2.2d and all 10.0.0 releases up to 10.0.0a1 are vulnerable. Later 9.2.2d and 10.0.1 builds contain the fix and are not affected.

The CVSS score is 6.8, indicating moderate severity, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to require the attacker to have write access to the configuration files used during service setup, which allows the attacker to trigger a denial of state of the management service. The EPSS score is not available, so the likelihood of exploitation is uncertain but the denial can be sustained indefinitely.