Description
An out-of-bounds memory read vulnerability exists in the web management daemon of Brocade Fabric OS versions before 10.0.1. Unauthenticated HTTP endpoints process specific URL query parameters without validating array index boundaries or performing numerical range checks. An unauthenticated remote attacker can exploit this issue by sending a single, crafted HTTP request containing extreme numerical values in the query string. This causes an invalid memory dereference, resulting in a crash of the web management process (Denial of Service) and potential temporary management-plane disruption.
Published: 2026-10-08
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Patch Now
AI Analysis

Impact

An out-of-bounds memory read flaw is present in the web management daemon of Brocade Fabric OS versions before 10.0.1. Unauthenticated HTTP requests can supply extreme numerical values in query parameters, bypassing array index checks, leading to an invalid memory dereference that crashes the web management process, thereby causing a denial of service and temporary disruption of management plane access.

Affected Systems

The vulnerability affects Brocade Fabric OS. Any version older than 10.0.1 is vulnerable. The affected product is the web management daemon component of Fabric OS.

Risk and Exploitability

The CVSS score of 7.1 indicates a high severity risk. The EPSS score of < 1% (0.00225) suggests a very low probability of exploit, but the vulnerability is unauthenticated and exploitable remotely via HTTP, so attackers could trigger a crash without credentials. The vulnerability is not listed in CISA’s KEV catalog, but because it can disrupt management‑plane availability, a system that relies on continuous management should consider patching immediately.

Generated by OpenCVE AI on October 8, 2026 at 21:38 UTC.

Remediation

Vendor Solution

Security update is provided in Brocade Fabric OS 10.0.1

OpenCVE Recommended Actions

  • Apply the Brocade Fabric OS 10.0.1 firmware update or later to fix the out-of-bounds read in the web management daemon
  • Limit external network access to the web management endpoints with firewall or network segmentation to block unauthenticated HTTP requests
  • Monitor web‑management logs for abnormal crashes or repeated invalid requests to detect potential exploitation attempts

Generated by OpenCVE AI on October 8, 2026 at 21:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
First Time appeared Broadcom
Broadcom fabric Operating System
CPEs cpe:2.3:o:broadcom:fabric_operating_system:*:*:*:*:*:*:*:*
Vendors & Products Broadcom
Broadcom fabric Operating System
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Thu, 08 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Title Out‑of‑Bounds Read in Brocade Fabric OS Web Management Daemon
Weaknesses CWE-190
CWE-787
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 08 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-125

Thu, 08 Oct 2026 03:45:00 +0000

Type Values Removed Values Added
Title Out‑of‑Bounds Read in Brocade Fabric OS Web Management Daemon
First Time appeared Brocade
Brocade fabric Os
Weaknesses CWE-190
CWE-787
Vendors & Products Brocade
Brocade fabric Os

Thu, 08 Oct 2026 02:45:00 +0000

Type Values Removed Values Added
Description An out-of-bounds memory read vulnerability exists in the web management daemon of Brocade Fabric OS versions before 10.0.1. Unauthenticated HTTP endpoints process specific URL query parameters without validating array index boundaries or performing numerical range checks. An unauthenticated remote attacker can exploit this issue by sending a single, crafted HTTP request containing extreme numerical values in the query string. This causes an invalid memory dereference, resulting in a crash of the web management process (Denial of Service) and potential temporary management-plane disruption.
References
Metrics cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Broadcom Fabric Operating System
Brocade Fabric Os
cve-icon MITRE

Status: PUBLISHED

Assigner: brocade

Published:

Updated: 2026-10-08T17:57:15.528Z

Reserved: 2026-09-08T22:51:12.166Z

Link: CVE-2026-87671

cve-icon Vulnrichment

Updated: 2026-10-08T14:57:16.875Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-08T03:16:36.650

Modified: 2026-10-13T17:15:46.667

Link: CVE-2026-87671

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-08T21:45:16Z

Weaknesses