CVE-2026-87678

MediumCVSS 5.2/10Last modified Oct 14, 2026

Description

An input validation and output encoding vulnerability exists in the web management interface of Brocade Fabric OS versions before 10.0.1. When configuring Federated Authentication (FA), the system fails to sanitize the Identity Provider (IdP) issuer parameter. An authenticated administrator—or an attacker capable of supplying crafted FA configuration files during an import routine—can inject arbitrary web server directives. This can lead to service denial by preventing the web management daemon from starting, or potentially alter web server security controls.

Metrics

CVSS 3.1 5.2/10CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H

Weakness enumeration

CWE-93

Affected software

No affected versions have been published.

Timeline

Published
Oct 8, 2026
Last modified
Oct 14, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-876797.2When Brocade Fabric OS versions before 10.0.1 processes trunk configuration operations, the application parses user-supplied list strings inCVE-2026-87687.3A vulnerability was found in vercel ai up to 3.0.97. The affected element is the function validateDownloadUrl of the file packages/provider-CVE-2026-876808.8A command injection vulnerability in the REST API management interface of Brocade Fabric OS versions before 10.0.1 allows an authenticated uCVE-2026-876816.3An Access Control Bypass vulnerability exists in the Role-Based Access Control (RBAC) validation engine of Brocade Fabric OS versions beforeCVE-2026-876828.8Multiple OS Command Injection vulnerabilities exist in the management interface and session processing routines of Brocade Fabric OS versionCVE-2026-876838.8Multiple stack-based buffer overflow vulnerabilities exist in the REST API management component of Brocade Fabric OS versions prior to 10.0.CVE-2026-876849.8A stack-based buffer overflow vulnerability exists in the SNMP daemon request handling of Brocade Fabric versions before 10.0.1. When procesCVE-2026-876856.8An arbitrary file manipulation vulnerability exists in the WebTools management interface of Brocade Fabric OS versions before 9.2.2d and 10.CVE-2026-876864.3An authentication and access control bypass vulnerability exists in the web server management interface of Brocade Fabric OS versions beforeCVE-2026-876877.3An authorization and input validation vulnerability exists in Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An autheCVE-2026-876886.8An input validation vulnerability exists in the security certificate management component of the Brocade Fabric OS administrative managementCVE-2026-876899.8The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServlet. Every mutat
CVE-2026-87678: Medium severity, CVSS 5.2 | Vulnix