The flaw resides in the Fabric OS AAA integration framework, permitting a remote authenticated user to bypass administrative role checks by returning specially crafted Vendor-Specific Attributes or directory claims from an external identity provider. Because the privilege escalation grants root-equivalent control over chassis access, an attacker can modify firmware, install persistent agents, or otherwise compromise the entire fabric. This vulnerability is an authorization logic error (CWE‑269).

All Brocade Fabric OS releases before version 10.0.1 are affected. Systems running these older images are vulnerable regardless of the external identity provider used (RADIUS, LDAP, TACACS+, or Federated IDP).

The CVSS score of 7.5 indicates a high severity condition. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers must first authenticate to the Fabric OS and to the external provider; once authenticated they may craft VSA or claim data to trigger the bypass. The remote authenticated nature of the attack makes it relatively accessible to threat actors with legitimate credentials or phishing capabilities.