CVE-2026-87684

CriticalCVSS 9.8/10Last modified Oct 14, 2026

Description

A stack-based buffer overflow vulnerability exists in the SNMP daemon request handling of Brocade Fabric versions before 10.0.1. When processing an incoming SNMPv3 packet, an internal statistics gathering handler copies user-supplied context name data into a fixed-size buffer without properly validating the length of the string. A remote, unauthenticated attacker (under default configuration) can exploit this vulnerability by sending a specially crafted SNMPv3 packet, leading to memory corruption, daemon crash (Denial of Service), or potential arbitrary code execution.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121

Affected software

No affected versions have been published.

Timeline

Published
Oct 8, 2026
Last modified
Oct 14, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-876856.8An arbitrary file manipulation vulnerability exists in the WebTools management interface of Brocade Fabric OS versions before 9.2.2d and 10.CVE-2026-876864.3An authentication and access control bypass vulnerability exists in the web server management interface of Brocade Fabric OS versions beforeCVE-2026-876877.3An authorization and input validation vulnerability exists in Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An autheCVE-2026-876886.8An input validation vulnerability exists in the security certificate management component of the Brocade Fabric OS administrative managementCVE-2026-876899.8The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServlet. Every mutatCVE-2026-87696.5A vulnerability was determined in vercel ai up to 3.0.97. The impacted element is the function createJsonResponseHandler/createJsonErrorRespCVE-2026-876908.8The Metasploit Framework post module post/apple_ios/gather/ios_image_gather is affected by a relative path traversal vulnerability (CWE-22).CVE-2026-876917.8Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally.CVE-2026-876927.8Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.CVE-2026-876937.0Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.CVE-2026-876947.8Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.CVE-2026-876957.8Inclusion of functionality from untrusted control sphere in Microsoft Exchange Server allows an authorized attacker to elevate privileges lo