Skip to main content

Brocade Fabric OS EUVDEUVD-2026-94678

| CVE-2026-87665 MEDIUM
Stack-based Buffer Overflow (CWE-121)
2026-10-08 brocade GHSA-v6r4-5332-gjp3
Buffer Overflow Denial Of Service Stack Overflow Fabric Os Brocade
6.0
CVSS 4.0 · Vendor: brocade
Share

Severity by source

Vendor (brocade) PRIMARY
6.0 MEDIUM
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.3 MEDIUM

Adjacent-network IKE reachability (AV:A), unauthenticated single packet (PR:N/UI:N), but AC:H to reflect the required non-default IPsec-FCIP configuration; impact is availability-only (A:H).

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (brocade).

CVSS VectorVendor: brocade

Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

4
Patch available
Oct 08, 2026 - 04:31 EUVD
Metadata Corrected
Oct 08, 2026 - 03:40 vuln.today
tag: Microsoft removed
Analysis Generated
Oct 08, 2026 - 03:36 vuln.today
CVE Published
Oct 08, 2026 - 02:58 cve.org
MEDIUM 6.0

DescriptionCVE.org

A stack-based buffer overflow vulnerability exists in the Internet Key Exchange (IKEv2) protocol handler on Brocade Fabric OS versions before 10.0.1. The vulnerability occurs when processing initial IKE key exchange requests on extension switches or blades running IPsec-enabled Fibre Channel over IP (FCIP) circuits. An unauthenticated remote attacker can exploit this vulnerability by sending a single, specifically crafted UDP packet (Port 500) containing an oversized Nonce payload. Successful exploitation results in a denial of service (data-plane process crash)

AnalysisAI

A single crafted IKEv2 packet with an oversized Nonce payload can crash the IPsec data-plane process on Brocade Fabric OS extension switches and blades running IPsec-enabled Fibre Channel over IP (FCIP) circuits. Only deployments that terminate IKEv2 on UDP port 500 are exposed, and the attacker needs IP reachability to that listener from the adjacent storage-extension network but no credentials (CVSS vector indicates PR:N). …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the target be a Brocade extension switch or blade with IPsec-enabled FCIP (Fibre Channel over IP) circuits configured and the IKEv2/IKE handler listening on UDP port 500 - this is a specialized, non-default deployment mode, not a stock SAN switch configuration. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment This is a moderate-priority availability issue, not a critical one, and the signals are internally consistent rather than conflicting. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade to Brocade Fabric OS 10.0.1 or later, which is the version boundary referenced by the vendor advisory (affected: versions before 10.0.1) - see https://support.broadcom.com/external/content/SecurityAdvisories/0/39148 for the authoritative fix and any platform-specific patch matrix. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Fabric Os

View all
CVE-2026-87682 HIGH
8.6 Oct 08

Authenticated OS command injection in the management interface and session-processing routines of Brocade Fabric OS allo
CVE-2026-94581 HIGH
8.5 Oct 08

Brocade Fabric OS contains an OS command injection flaw in the REST API management interface that lets an authenticated,
CVE-2026-94586 HIGH
8.5 Oct 08

OS command injection in the WebTools administrative interface of Brocade Fabric OS lets an authenticated, high-privilege
CVE-2026-87684 HIGH
8.7 Oct 08

Stack-based buffer overflow in the SNMP daemon of Brocade Fabric OS (all versions before 10.0.1) lets a remote, unauthen
CVE-2026-87680 HIGH
8.5 Oct 08

Command injection in the REST API management interface of Brocade Fabric OS allows an authenticated low-privileged user

CVE-2026-87683 HIGH
8.6 Oct 08

Authenticated attackers with access to the adjacent management network can exploit stack-based buffer overflows in the R
CVE-2026-87687 HIGH
8.5 Oct 08

An authenticated, low-privileged user in one Virtual Fabric on a Brocade Fabric OS switch can submit a request carrying

CVE-2026-87679 HIGH
8.5 Oct 08

Heap corruption in Brocade Fabric OS before 10.0.1 allows an authenticated administrator to crash a SAN switch's managem
CVE-2026-87664 HIGH
8.5 Oct 08

Authentication bypass in Brocade Fabric OS 9.2.2d and 10.0.0 through 10.0.0a1 allows a local low-privileged process to f
CVE-2026-87674 HIGH
8.5 Oct 08

Local privilege escalation in Brocade Fabric OS (versions before 9.2.2d and 10.0.0 through 10.0.0a1) allows an unprivile
CVE-2026-87688 HIGH
8.5 Oct 08

Command injection in the security certificate management component of the Brocade Fabric OS administrative management AP
CVE-2026-87685 HIGH
8.4 Oct 08

An arbitrary file-move flaw in the WebTools management interface of Brocade Fabric OS (all builds before 9.2.2d and 10.0

Same weakness CWE-121 – Stack-based Buffer Overflow

View all
CVE-2025-0282 CRITICAL POC
9.0
CVE-2025-22457 CRITICAL POC
9.8
CVE-2012-10060 CRITICAL POC
9.3
CVE-2012-10053 CRITICAL POC
9.3
CVE-2013-10064 CRITICAL POC
9.3
CVE-2012-10023 MEDIUM POC
6.9
CVE-2012-10058 CRITICAL POC
10.0
CVE-2013-10068 CRITICAL POC
9.4

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Share

EUVD-2026-94678 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy