CVE-2026-87679

HighCVSS 7.2/10Last modified Oct 13, 2026

Description

When Brocade Fabric OS versions before 10.0.1 processes trunk configuration operations, the application parses user-supplied list strings into dynamically allocated heap arrays without enforcing boundary checks on the maximum allowable number of elements. An authenticated administrator can exploit this vulnerability via crafted REST API requests containing an excessive number of list delimiters, causing heap corruption that can result in service crash or arbitrary code execution.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122

Affected software

Vendor	Product	Versions
Brocade	Fabric OS	< 10.0.1

References

https://support.broadcom.com/external/content/SecurityAdvisories/0/39073Vendor Advisory

Timeline

Published: Oct 8, 2026
Last modified: Oct 13, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-87687.3A vulnerability was found in vercel ai up to 3.0.97. The affected element is the function validateDownloadUrl of the file packages/provider-CVE-2026-876808.8A command injection vulnerability in the REST API management interface of Brocade Fabric OS versions before 10.0.1 allows an authenticated u CVE-2026-876816.3An Access Control Bypass vulnerability exists in the Role-Based Access Control (RBAC) validation engine of Brocade Fabric OS versions before CVE-2026-876828.8Multiple OS Command Injection vulnerabilities exist in the management interface and session processing routines of Brocade Fabric OS version CVE-2026-876838.8Multiple stack-based buffer overflow vulnerabilities exist in the REST API management component of Brocade Fabric OS versions prior to 10.0.CVE-2026-876849.8A stack-based buffer overflow vulnerability exists in the SNMP daemon request handling of Brocade Fabric versions before 10.0.1. When proces CVE-2026-876856.8An arbitrary file manipulation vulnerability exists in the WebTools management interface of Brocade Fabric OS versions before 9.2.2d and 10.CVE-2026-876864.3An authentication and access control bypass vulnerability exists in the web server management interface of Brocade Fabric OS versions before CVE-2026-876877.3An authorization and input validation vulnerability exists in Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authe CVE-2026-876886.8An input validation vulnerability exists in the security certificate management component of the Brocade Fabric OS administrative management CVE-2026-876899.8The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServlet. Every mutat CVE-2026-87696.5A vulnerability was determined in vercel ai up to 3.0.97. The impacted element is the function createJsonResponseHandler/createJsonErrorResp