CVE-2026-87680
Broadcom Fabric Operating System: OS command injection
- Risk score
- 69/100
- CVSS
- 8.8 v3.1
- Exploit chance (30 days)
- 1.9%
- Published
- 8 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A command injection vulnerability in the REST API management interface of Brocade Fabric OS versions before 10.0.1 allows an authenticated user to execute arbitrary system commands via crafted input parameters.
- Affected
- Broadcom Fabric Operating System before 10.0.1
- Fix
- Upgrade Broadcom Fabric Operating System to 10.0.1 or later.
- Exploitation
- No known exploitation
Story map
At a glance
Broadcom Fabric Operating System: Amber, patch this week. A stack-based buffer overflow vulnerability exists in the SNMP daemon request handling of Brocade Fabric versions before 10.0.1. When processing an incoming SNMPv3 packet, an internal statistics gathering handler copies user-supplied context name data into a fixed-size buffer without properly validating the length of …
The flaws
- CVE-2026-87680: OS command injection (CVSS 8.8 · EPSS 2%)
- CVE-2026-87684: Stack buffer overflow can lead to remote code execution (CVSS 9.8 · EPSS 1%)
- CVE-2026-87682: OS command injection (CVSS 8.8 · EPSS 2%)
- CVE-2026-87659: Missing authentication (CVSS 9.8 · EPSS 0%)
The fix
Upgrade Broadcom Fabric Operating System: 10.0.1 or later on your release line
Who is exposed: Broadcom Fabric Operating System before 10.0.1
Where it stands
- No known exploitation
Connects to
- Same weakness: OS command injection (CWE-78). 307 other warnings in 30 days
- Same product: Earlier Broadcom Fabric Operating System warnings. 39 in the last 90 days
Why it is Amber
- CVSS 8.8 high
References
Original description
A command injection vulnerability in the REST API management interface of Brocade Fabric OS versions before 10.0.1 allows an authenticated user to execute arbitrary system commands via crafted input parameters.
Last activity 8 Oct 2026. Patch Forecast updates every hour.