Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-87671

Broadcom Fabric Operating System: out-of-bounds read can lead to denial of service

Risk score
57/100
CVSS
7.5 v3.1
Exploit chance (30 days)
0.4%
Published
8 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
An out-of-bounds memory read vulnerability exists in the web management daemon of Brocade Fabric OS versions before 10.0.1. Unauthenticated HTTP endpoints process specific URL query parameters without validating array index boundaries or performing numerical range checks. An unauthenticated remote attacker can exploit…
Affected
Broadcom Fabric Operating System before 10.0.1
Fix
Upgrade Broadcom Fabric Operating System to 10.0.1 or later.
Exploitation
No known exploitation

Story map

Story map: Broadcom Fabric Operating SystemTHE FLAWSTHE FIXCVE-2026-87671Out-of-bounds read can lead todenial of serviceCVSS 7.5 · EPSS 0%CVE-2026-87684Stack buffer overflow can leadto remote code executionCVSS 9.8 · EPSS 1%CVE-2026-87680OS command injectionCVSS 8.8 · EPSS 2%CVE-2026-87682OS command injectionCVSS 8.8 · EPSS 2%Upgrade Broadcom Fabric…10.0.1or later on your release lineWho is exposedBroadcom Fabric OperatingSystem before 10.0.1AMBER · PATCH THIS WEEKBroadcom FabricOperating SystemA stack-based buffer overflowvulnerability exists in the SNMPdaemon request handling ofBrocade Fabric versions before10.0.1. When processing anincoming SNMPv3 packet, aninternal statistics gathering…Where it standsNo known exploitationCONNECTS TOSame weaknessOut-of-bounds read (CWE-125)348 other warnings in 30 days →Same productEarlier Broadcom Fabric Operating System warnings39 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Broadcom Fabric Operating System: Amber, patch this week. A stack-based buffer overflow vulnerability exists in the SNMP daemon request handling of Brocade Fabric versions before 10.0.1. When processing an incoming SNMPv3 packet, an internal statistics gathering handler copies user-supplied context name data into a fixed-size buffer without properly validating the length of …

The flaws

  • CVE-2026-87671: Out-of-bounds read can lead to denial of service (CVSS 7.5 · EPSS 0%)
  • CVE-2026-87684: Stack buffer overflow can lead to remote code execution (CVSS 9.8 · EPSS 1%)
  • CVE-2026-87680: OS command injection (CVSS 8.8 · EPSS 2%)
  • CVE-2026-87682: OS command injection (CVSS 8.8 · EPSS 2%)

The fix

Upgrade Broadcom Fabric Operating System: 10.0.1 or later on your release line

Who is exposed: Broadcom Fabric Operating System before 10.0.1

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 7.5 high
  • Remotely exploitable without logging in

References

Original description

An out-of-bounds memory read vulnerability exists in the web management daemon of Brocade Fabric OS versions before 10.0.1. Unauthenticated HTTP endpoints process specific URL query parameters without validating array index boundaries or performing numerical range checks. An unauthenticated remote attacker can exploit this issue by sending a single, crafted HTTP request containing extreme numerical values in the query string. This causes an invalid memory dereference, resulting in a crash of the web management process (Denial of Service) and potential temporary management-plane disruption.

Last activity 8 Oct 2026. Patch Forecast updates every hour.