CVE-2026-94582

Broadcom Fabric Operating System: buffer overflow can lead to remote code execution

Risk score: 48/100
CVSS: 7.8 v3.1
Exploit chance (30 days): 0.1%
Published: 8 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: A memory buffer overflow vulnerability exists in the internal diagnostic and route validation routines used by the Fabric Shortest Path First (FSPF) protocol component of Brocade Fabric OS versions before 10.0.1. While this code path is part of internal diagnostic functionality and is not directly accessible via stand…
Affected: Broadcom Fabric Operating System before 10.0.1
Fix: Upgrade Broadcom Fabric Operating System to 10.0.1 or later.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Broadcom Fabric Operating System: Amber, patch this week. A stack-based buffer overflow vulnerability exists in the SNMP daemon request handling of Brocade Fabric versions before 10.0.1. When processing an incoming SNMPv3 packet, an internal statistics gathering handler copies user-supplied context name data into a fixed-size buffer without properly validating the length of …

The flaws

CVE-2026-94582: Buffer overflow can lead to remote code execution (CVSS 7.8 · EPSS 0%)
CVE-2026-87684: Stack buffer overflow can lead to remote code execution (CVSS 9.8 · EPSS 1%)
CVE-2026-87680: OS command injection (CVSS 8.8 · EPSS 2%)
CVE-2026-87682: OS command injection (CVSS 8.8 · EPSS 2%)

The fix

Upgrade Broadcom Fabric Operating System: 10.0.1 or later on your release line

Who is exposed: Broadcom Fabric Operating System before 10.0.1

Where it stands

No known exploitation

Connects to

Same weakness: Buffer overflow (CWE-120). 34 other warnings in 30 days
Same product: Earlier Broadcom Fabric Operating System warnings. 39 in the last 90 days

Why it is Yellow

CVSS 7.8 high

References

https://support.broadcom.com/external/content/SecurityAdvisories/0/39161

Original description

A memory buffer overflow vulnerability exists in the internal diagnostic and route validation routines used by the Fabric Shortest Path First (FSPF) protocol component of Brocade Fabric OS versions before 10.0.1. While this code path is part of internal diagnostic functionality and is not directly accessible via standard user interfaces or CLI management commands, an input processing flaw allows incoming or internally routed diagnostic state payloads to exceed allocated memory boundaries. An attacker that is able to chain or link other vulnerabilities to exploit this internal diagnostic could cause a heap- or stack-based memory overrun, resulting in a daemon crash (Denial of Service) or potential arbitrary code execution within the context of the routing daemon.

Last activity 8 Oct 2026. Patch Forecast updates every hour.