CVE-2026-87684

Broadcom Fabric Operating System: stack buffer overflow can lead to remote code execution

Risk score: 73/100
CVSS: 9.8 v3.1
Exploit chance (30 days): 0.6%
Published: 8 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: A stack-based buffer overflow vulnerability exists in the SNMP daemon request handling of Brocade Fabric versions before 10.0.1. When processing an incoming SNMPv3 packet, an internal statistics gathering handler copies user-supplied context name data into a fixed-size buffer without properly validating the length of …
Affected: Broadcom Fabric Operating System before 10.0.1
Fix: Upgrade Broadcom Fabric Operating System to 10.0.1 or later.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Broadcom Fabric Operating System: Amber, patch this week. A stack-based buffer overflow vulnerability exists in the SNMP daemon request handling of Brocade Fabric versions before 10.0.1. When processing an incoming SNMPv3 packet, an internal statistics gathering handler copies user-supplied context name data into a fixed-size buffer without properly validating the length of …

The flaws

CVE-2026-87684: Stack buffer overflow can lead to remote code execution (CVSS 9.8 · EPSS 1%)
CVE-2026-87680: OS command injection (CVSS 8.8 · EPSS 2%)
CVE-2026-87682: OS command injection (CVSS 8.8 · EPSS 2%)
CVE-2026-87659: Missing authentication (CVSS 9.8 · EPSS 0%)

The fix

Upgrade Broadcom Fabric Operating System: 10.0.1 or later on your release line

Who is exposed: Broadcom Fabric Operating System before 10.0.1

Where it stands

No known exploitation

Connects to

Same weakness: Stack buffer overflow (CWE-121). 195 other warnings in 30 days
Same product: Earlier Broadcom Fabric Operating System warnings. 39 in the last 90 days

Why it is Amber

CVSS 9.8 critical
Remotely exploitable without logging in

References

https://support.broadcom.com/external/content/SecurityAdvisories/0/39078

Original description

A stack-based buffer overflow vulnerability exists in the SNMP daemon request handling of Brocade Fabric versions before 10.0.1. When processing an incoming SNMPv3 packet, an internal statistics gathering handler copies user-supplied context name data into a fixed-size buffer without properly validating the length of the string. A remote, unauthenticated attacker (under default configuration) can exploit this vulnerability by sending a specially crafted SNMPv3 packet, leading to memory corruption, daemon crash (Denial of Service), or potential arbitrary code execution.

Last activity 8 Oct 2026. Patch Forecast updates every hour.