CVE-2026-87682

HighCVSS 8.8/10Last modified Oct 13, 2026

Description

Multiple OS Command Injection vulnerabilities exist in the management interface and session processing routines of Brocade Fabric OS versions before 10.0.1. Input processing flaws during remote management connection validation and session verification for directory-based user accounts allow untrusted input containing shell metacharacters to reach internal system execution wrappers. An authenticated user or a compromised directory service account can exploit these vulnerabilities to execute arbitrary operating system commands with elevated privileges on the target device.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Oct 8, 2026
Last modified: Oct 13, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-876838.8Multiple stack-based buffer overflow vulnerabilities exist in the REST API management component of Brocade Fabric OS versions prior to 10.0.CVE-2026-876849.8A stack-based buffer overflow vulnerability exists in the SNMP daemon request handling of Brocade Fabric versions before 10.0.1. When proces CVE-2026-876856.8An arbitrary file manipulation vulnerability exists in the WebTools management interface of Brocade Fabric OS versions before 9.2.2d and 10.CVE-2026-876864.3An authentication and access control bypass vulnerability exists in the web server management interface of Brocade Fabric OS versions before CVE-2026-876877.3An authorization and input validation vulnerability exists in Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authe CVE-2026-876886.8An input validation vulnerability exists in the security certificate management component of the Brocade Fabric OS administrative management CVE-2026-876899.8The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServlet. Every mutat CVE-2026-87696.5A vulnerability was determined in vercel ai up to 3.0.97. The impacted element is the function createJsonResponseHandler/createJsonErrorResp CVE-2026-876908.8The Metasploit Framework post module post/apple_ios/gather/ios_image_gather is affected by a relative path traversal vulnerability (CWE-22).CVE-2026-876917.8Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally.CVE-2026-876927.8Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.CVE-2026-876937.0Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.