CVE-2026-87680

HighCVSS 8.8/10Last modified Oct 13, 2026

Description

A command injection vulnerability in the REST API management interface of Brocade Fabric OS versions before 10.0.1 allows an authenticated user to execute arbitrary system commands via crafted input parameters.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Oct 8, 2026
Last modified: Oct 13, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-876816.3An Access Control Bypass vulnerability exists in the Role-Based Access Control (RBAC) validation engine of Brocade Fabric OS versions before CVE-2026-876828.8Multiple OS Command Injection vulnerabilities exist in the management interface and session processing routines of Brocade Fabric OS version CVE-2026-876838.8Multiple stack-based buffer overflow vulnerabilities exist in the REST API management component of Brocade Fabric OS versions prior to 10.0.CVE-2026-876849.8A stack-based buffer overflow vulnerability exists in the SNMP daemon request handling of Brocade Fabric versions before 10.0.1. When proces CVE-2026-876856.8An arbitrary file manipulation vulnerability exists in the WebTools management interface of Brocade Fabric OS versions before 9.2.2d and 10.CVE-2026-876864.3An authentication and access control bypass vulnerability exists in the web server management interface of Brocade Fabric OS versions before CVE-2026-876877.3An authorization and input validation vulnerability exists in Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authe CVE-2026-876886.8An input validation vulnerability exists in the security certificate management component of the Brocade Fabric OS administrative management CVE-2026-876899.8The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServlet. Every mutat CVE-2026-87696.5A vulnerability was determined in vercel ai up to 3.0.97. The impacted element is the function createJsonResponseHandler/createJsonErrorResp CVE-2026-876908.8The Metasploit Framework post module post/apple_ios/gather/ios_image_gather is affected by a relative path traversal vulnerability (CWE-22).CVE-2026-876917.8Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally.