CVE Feed

    Dashboard / CVE / CVE-2026-87679

    CVE-2026-87679

    When Brocade Fabric OS versions before 10.0.1 processes trunk configuration operations, the application parses user-supplied list strings into dynamically allocated heap arrays without enforcing boundary checks on the maximum allowable number of elements. An authenticated administrator can exploit this vulnerability via crafted REST API requests containing an excessive number of list delimiters, causing heap corruption that can result in service crash or arbitrary code execution.

    Published:Oct 8, 2026
    Last Modified:Oct 13, 2026
    EPS:Oct 8, 2026
    EPSS Score:0.00161
    CVSS Score:7.2

    Affected Products

    Vendor
    Broadcom
    Product
    Fabric Operating System
    Vendor
    Brocade
    Product
    Fabric Os

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-122 Heap-based Buffer Overflow

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-92 Forced Integer Overflow

    Related CVEs

    CVE-2026-94585 (CVSS 7.7) — An authentication bypass vulnerability exists in the web management interface of Brocade Fabric OS versions be…
    CVE-2026-94587 (CVSS 6.9) — A buffer overflow vulnerability exists in the WebTools administrative interface handling configuration downloa…
    CVE-2026-94579 (CVSS 5.4) — An OS command injection vulnerability exists in the PAM (Pluggable Authentication Module) session cleanup rout…
    CVE-2026-94576 (CVSS 5.9) — An authentication logic and privilege escalation vulnerability exists in the account management interface of B…
    CVE-2026-87661 (CVSS 6.8) — Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 directly accepts Apache configuration fil…
    CVE-2026-87677 (CVSS 5.4) — An OS command injection vulnerability exists in the account management subsystem of Brocade Fabric OS versions…
    CVE-2026-94586 (CVSS 8.5) — A command injection vulnerability exists in the WebTools administrative interface handling configuration downl…
    CVE-2026-94581 (CVSS 8.5) — An OS command injection vulnerability exists in the REST API management interface of Brocade Fabric OS version…
    CVE-2026-94577 (CVSS 7.3) — A privilege escalation vulnerability exists in the internal Command-Line Interface (CLI) authorization handlin…
    CVE-2026-87664 (CVSS 8.5) — A session context forgery vulnerability exists in the web management daemon of Brocade Fabric OS versions 9.2.…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High