CVE-2026-87673

Broadcom Fabric Operating System: OS command injection

Risk score: 59/100
CVSS: 7.2 v3.1
Exploit chance (30 days): 1.8%
Published: 8 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: An OS command injection vulnerability exists in maintenance command-line diagnostic utilities on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. The binary fails to sanitize user-supplied input options when invoking underlying system commands through a shell interpreter. A privileged user with ma…
Affected: Broadcom Fabric Operating System before 9.2.2
Fix: Upgrade Broadcom Fabric Operating System to 9.2.2 or later.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Broadcom Fabric Operating System: Amber, patch this week. A stack-based buffer overflow vulnerability exists in the SNMP daemon request handling of Brocade Fabric versions before 10.0.1. When processing an incoming SNMPv3 packet, an internal statistics gathering handler copies user-supplied context name data into a fixed-size buffer without properly validating the length of …

The flaws

CVE-2026-87673: OS command injection (CVSS 7.2 · EPSS 2%)
CVE-2026-87684: Stack buffer overflow can lead to remote code execution (CVSS 9.8 · EPSS 1%)
CVE-2026-87680: OS command injection (CVSS 8.8 · EPSS 2%)
CVE-2026-87682: OS command injection (CVSS 8.8 · EPSS 2%)

The fix

Upgrade Broadcom Fabric Operating System: 9.2.2 · 10.0.1 or later on your release line

Who is exposed: Broadcom Fabric Operating System before 10.0.1

Where it stands

No known exploitation

Connects to

Same weakness: OS command injection (CWE-78). 306 other warnings in 30 days
Same product: Earlier Broadcom Fabric Operating System warnings. 39 in the last 90 days

Why it is Yellow

CVSS 7.2 high

References

https://support.broadcom.com/external/content/SecurityAdvisories/0/39144

Original description

An OS command injection vulnerability exists in maintenance command-line diagnostic utilities on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. The binary fails to sanitize user-supplied input options when invoking underlying system commands through a shell interpreter. A privileged user with maintenance account access can exploit this issue by supplying crafted parameters, which results in arbitrary OS command execution with root privileges.

Last activity 8 Oct 2026. Patch Forecast updates every hour.