CVE-2026-87671

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-08 · updated 2026-10-13
Weakness: CWE-125

Description

An out-of-bounds memory read vulnerability exists in the web management daemon of Brocade Fabric OS versions before 10.0.1. Unauthenticated HTTP endpoints process specific URL query parameters without validating array index boundaries or performing numerical range checks. An unauthenticated remote attacker can exploit this issue by sending a single, crafted HTTP request containing extreme numerical values in the query string. This causes an invalid memory dereference, resulting in a crash of the web management process (Denial of Service) and potential temporary management-plane disruption.

Affected products

Brocade Fabric OS: before 10.0.1 — fixed in 10.0.1

How to fix

Upgrade to a fixed version: Brocade Fabric OS 10.0.1. Check the vendor advisory for mitigations.

References

https://support.broadcom.com/external/content/SecurityAdvisories/0/39141

Get alerted when CVE-2026-87671 or the next vulnerability affects your stack