CVE-2026-87682

Broadcom Fabric Operating System: OS command injection

Risk score: 68/100
CVSS: 8.8 v3.1
Exploit chance (30 days): 1.7%
Published: 8 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: Multiple OS Command Injection vulnerabilities exist in the management interface and session processing routines of Brocade Fabric OS versions before 10.0.1. Input processing flaws during remote management connection validation and session verification for directory-based user accounts allow untrusted input containing …
Affected: Broadcom Fabric Operating System before 10.0.1
Fix: Upgrade Broadcom Fabric Operating System to 10.0.1 or later.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Broadcom Fabric Operating System: Amber, patch this week. A stack-based buffer overflow vulnerability exists in the SNMP daemon request handling of Brocade Fabric versions before 10.0.1. When processing an incoming SNMPv3 packet, an internal statistics gathering handler copies user-supplied context name data into a fixed-size buffer without properly validating the length of …

The flaws

CVE-2026-87682: OS command injection (CVSS 8.8 · EPSS 2%)
CVE-2026-87684: Stack buffer overflow can lead to remote code execution (CVSS 9.8 · EPSS 1%)
CVE-2026-87680: OS command injection (CVSS 8.8 · EPSS 2%)
CVE-2026-87659: Missing authentication (CVSS 9.8 · EPSS 0%)

The fix

Upgrade Broadcom Fabric Operating System: 10.0.1 or later on your release line

Who is exposed: Broadcom Fabric Operating System before 10.0.1

Where it stands

No known exploitation

Connects to

Same weakness: OS command injection (CWE-78). 307 other warnings in 30 days
Same product: Earlier Broadcom Fabric Operating System warnings. 39 in the last 90 days

Why it is Amber

CVSS 8.8 high

References

https://support.broadcom.com/external/content/SecurityAdvisories/0/39076

Original description

Multiple OS Command Injection vulnerabilities exist in the management interface and session processing routines of Brocade Fabric OS versions before 10.0.1. Input processing flaws during remote management connection validation and session verification for directory-based user accounts allow untrusted input containing shell metacharacters to reach internal system execution wrappers. An authenticated user or a compromised directory service account can exploit these vulnerabilities to execute arbitrary operating system commands with elevated privileges on the target device.

Last activity 8 Oct 2026. Patch Forecast updates every hour.