Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.9
CVE-2026-87678: Brocade Fabric OS web UI can disrupt service
CVE-2026-87678 · published 28 days ago
Summary
The web management interface in Brocade Fabric OS versions before 10.0.1 does not properly clean certain configuration data. An administrator or a crafted import file can insert harmful commands that stop the web management service or change its security settings. Update to the latest version or apply the vendor’s patch to fix the issue.
What to do
- Update brocade fabric os to version 10.0.1 or later.
- Update broadcom fabric_operating_system to version 10.0.1 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| brocade | fabric os | < 10.0.1 |
| broadcom | fabric_operating_system |
< 10.0.1 cpe:2.3:o:broadcom:fabric_operating_system:*:*:*:*:*:*:*:* |
Original advisory text
An input validation and output encoding vulnerability exists in the web management interface of Brocade Fabric OS versions before 10.0.1. When configuring Federated Authentication (FA), the system ...
An input validation and output encoding vulnerability exists in the web management interface of Brocade Fabric OS versions before 10.0.1. When configuring Federated Authentication (FA), the system fails to sanitize the Identity Provider (IdP) issuer parameter. An authenticated administrator—or an attacker capable of supplying crafted FA configuration files during an import routine—can inject arbitrary web server directives. This can lead to service denial by preventing the web management daemon from starting, or potentially alter web server security controls.
References
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-93Improper Neutralization of CRLF Sequences ('CRLF Injection')
Timeline
Published8 Oct 2026
Updated29 Oct 2026
First seen8 Oct 2026
Track software like this
Free during beta