Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-87660

An improper file permission and missing authorization vulnerability exists in the diagnostic kernel…

Risk score
43/100
CVSS
7.1 v3.1
Exploit chance (30 days)
0.1%
Published
8 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
An improper file permission and missing authorization vulnerability exists in the diagnostic kernel module subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An unprivileged local user can invoke privileged hardware tests, force system error conditions, reset hardware blades, or disrupt…
Affected
Broadcom Fabric Operating System before 9.2, 9.2.2
Fix
Upgrade Broadcom Fabric Operating System to 9.2 or 9.2.2 (whichever matches your release line), or later.
Exploitation
No known exploitation

Story map

Story map: Broadcom Fabric Operating SystemTHE FLAWSTHE FIXCVE-2026-87660An improper file permission andmissing authorizationvulnerability exists in the…CVSS 7.1 · EPSS 0%CVE-2026-87684Stack buffer overflow can leadto remote code executionCVSS 9.8 · EPSS 1%CVE-2026-87680OS command injectionCVSS 8.8 · EPSS 2%CVE-2026-87682OS command injectionCVSS 8.8 · EPSS 2%Upgrade Broadcom Fabric…9.2 · 9.2.2 · 10.0.1or later on your release lineWho is exposedBroadcom Fabric OperatingSystem before 10.0.1AMBER · PATCH THIS WEEKBroadcom FabricOperating SystemA stack-based buffer overflowvulnerability exists in the SNMPdaemon request handling ofBrocade Fabric versions before10.0.1. When processing anincoming SNMPv3 packet, aninternal statistics gathering…Where it standsNo known exploitationCONNECTS TOSame weaknessCWE-732 (CWE-732)37 other warnings in 30 days →Same productEarlier Broadcom Fabric Operating System warnings39 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Broadcom Fabric Operating System: Amber, patch this week. A stack-based buffer overflow vulnerability exists in the SNMP daemon request handling of Brocade Fabric versions before 10.0.1. When processing an incoming SNMPv3 packet, an internal statistics gathering handler copies user-supplied context name data into a fixed-size buffer without properly validating the length of …

The flaws

  • CVE-2026-87660: An improper file permission and missing authorization vulnerability exists in the diagnostic kernel… (CVSS 7.1 · EPSS 0%)
  • CVE-2026-87684: Stack buffer overflow can lead to remote code execution (CVSS 9.8 · EPSS 1%)
  • CVE-2026-87680: OS command injection (CVSS 8.8 · EPSS 2%)
  • CVE-2026-87682: OS command injection (CVSS 8.8 · EPSS 2%)

The fix

Upgrade Broadcom Fabric Operating System: 9.2 · 9.2.2 · 10.0.1 or later on your release line

Who is exposed: Broadcom Fabric Operating System before 10.0.1

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 7.1 high

References

Original description

An improper file permission and missing authorization vulnerability exists in the diagnostic kernel module subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An unprivileged local user can invoke privileged hardware tests, force system error conditions, reset hardware blades, or disrupt storage fabric operations.

Last activity 8 Oct 2026. Patch Forecast updates every hour.