87
CVEs
3
Critical
52
High
1
KEV
7
PoC
18
Unpatched C/H
69.0%
Patch Rate
1.7%
Avg EPSS
Severity Breakdown
CRITICAL
3
HIGH
52
MEDIUM
30
LOW
2
Monthly CVE Trend
Affected Products (30)
Fabric Os
40
Brocade Active Support Connectivity Gateway
12
Fabric Operating System
10
Sannav
8
Debian Linux
6
H500s Firmware
5
H300s Firmware
5
H410s Firmware
5
H700s Firmware
5
Solidfire Hci Management Node
4
Cloud Backup
4
Universal Forwarder
4
Fedora
4
Curl
4
Clustered Data Ontap
4
Solidfire Hci Storage Node
4
Splunk
4
Sqlite
3
Outside In Technology
3
Sinec Infrastructure Network Services
3
Vyatta 5400 Vrouter
3
Hci Bootstrap Os
3
Brocade Sannav
3
Ubuntu Linux
3
Hci Compute Node Firmware
3
Zfs Storage Appliance Kit
3
Solidfire Enterprise Sds Hci Storage Node
3
Vyatta 5400 Vrouter Software
3
Communications Network Charging And Control
3
Network Advisor
3
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2021-22555 | A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available. | HIGH | 7.8 | 78.7% | 203 |
KEV
PoC
|
| CVE-2016-8205 | A Directory Traversal vulnerability in DashboardFileReceiveServlet in the Brocade Network Advisor versions released prior to and including 14.0.2 could allow remote attackers to upload a malicious. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 24.1% and no vendor patch available. | CRITICAL | 9.8 | 24.1% | 73 |
No patch
|
| CVE-2026-82370 | Command injection in Brocade SANnav orchestrator versions before 3.0.1a enables network-adjacent attackers to execute arbitrary administrative Fibre Channel switch CLI commands and manipulate container runtimes, achieving high impact on confidentiality, integrity, and availability. The vendor CVSS 4.0 score is 8.6 (AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H); however, our independent assessment using CVSS 3.1 rates it 8.8 with PR:N (unauthenticated), and the description states unauthenticated while the vector indicates PR:L - authentication requirements are not confirmed from available data. No public exploit code has been identified at time of analysis, and there is no evidence of active exploitation (CISA KEV). | HIGH | 8.6 | 0.6% | 64 |
PoC
No patch
|
| CVE-2026-14443 | Incomplete log sanitization in Brocade SANnav before 3.0.1a causes extension switch IPsec pre-shared keys (PSKs) to be written in cleartext to system logs during the bulk IPsec policy collection workflow, allowing any principal with read access to container logs or exported support archives to recover those keys and potentially compromise the IPsec-protected tunnels that rely on them. The issue is local and authenticated (CVSS 3.1 AV:L/AC:L/PR:L/UI:N, confidentiality-only per independent assessment), not remotely reachable, and it is tied specifically to that diagnostic collection path rather than to arbitrary attacker input; no public exploit code has been identified at time of analysis. The 8.4 CVSS 4.0 vendor score (which also asserts high integrity impact via VI:H) should not be used as the sole triage signal, since the practical outcome depends on the attacker both holding log/support-bundle read privileges and being able to reach and reuse the leaked PSKs against the switch fabric. | HIGH | 8.4 | 0.1% | 62 |
PoC
No patch
|
| CVE-2022-22576 | An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.1 | 0.3% | 61 |
PoC
No patch
|
| CVE-2022-27775 | An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the connection pool but with a different zone id it could reuse a. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.5 | 0.2% | 58 |
PoC
No patch
|
| CVE-2022-27776 | A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host but another port number. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 6.5 | 3.4% | 56 |
PoC
No patch
|
| CVE-2022-33186 | A vulnerability in Brocade Fabric OS software v9.1.1, v9.0.1e, v8.2.3c, v7.4.2j, and earlier versions could allow a remote unauthenticated attacker to execute on a Brocade Fabric OS switch commands. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 1.5% | 51 |
No patch
|
| CVE-2022-27774 | An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is. Rated medium severity (CVSS 5.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 5.7 | 0.3% | 49 |
PoC
No patch
|
| CVE-2016-8206 | A Directory Traversal vulnerability in servlet SoftwareImageUpload in the Brocade Network Advisor versions released prior to and including 14.0.2 could allow remote attackers to write to arbitrary. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 10.4% and no vendor patch available. | HIGH | 7.5 | 10.4% | 48 |
No patch
|
| CVE-2014-4868 | The management console on the Brocade Vyatta 5400 vRouter 6.4R(x), 6.6R(x), and 6.7R1 allows remote authenticated users to execute arbitrary Linux commands via shell metacharacters in a console. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available. | CRITICAL | 9.0 | 0.2% | 45 |
No patch
|
| CVE-2026-87682 | Authenticated OS command injection in the management interface and session-processing routines of Brocade Fabric OS allows a low-privilege Fabric OS account - or an attacker who controls a directory-service account trusted by the switch - to smuggle shell metacharacters into connection-validation and session-verification input and reach internal execution wrappers, running arbitrary operating-system commands with elevated privileges on the SAN switch. Only Fabric OS versions before 10.0.1 are affected, and exploitation requires network reachability to the management interface over an adjacent or management network plus prior authentication (CVSS:4.0 base 8.6; the independent assessment concurs on AV:A/PR:L/UI:N with high confidentiality, integrity and availability impact). No public exploit code identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so it is best treated as an insider/lateral-movement risk on segmentation-exposed management planes rather than an opportunistic internet-facing emergency. | HIGH | 8.6 | 0.9% | 44 |
|
| CVE-2026-94581 | Brocade Fabric OS contains an OS command injection flaw in the REST API management interface that lets an authenticated, high-privileged administrator execute arbitrary commands as root on the underlying switch host by supplying shell metacharacters in SSH known-host configuration parameters. Affected deployments are Fabric OS releases before 9.2.2d and the 10.0.0 through 10.0.0a1 range; the vulnerability carries a CVSS v4.0 base score of 8.5 (High) and an equivalent CVSS v3.1 assessment of 8.5, with the practical risk tempered because an attacker must already hold administrative rights and reach the switch over an adjacent management network rather than the open Internet. No public exploit code or confirmed active exploitation was identified at time of analysis, so this is a constrained-priority issue for SAN administrators rather than an emergency patch-everything event. | HIGH | 8.5 | 1.3% | 44 |
|
| CVE-2026-82368 | Brocade SANnav deployments running versions before 3.0.1a expose backend management service ports without adequate access controls, so a local, non-administrative user on the SANnav host can talk directly to those services and relay commands to interconnected Fabric OS switches under the SANnav management user's identity. Exploitation is access-gated: it requires an authenticated low-privileged account on the host (PR:L, consistent across both the vendor CVSS 4.0 vector and our assessed CVSS:3.1 vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) plus a SANnav instance that is actively managing switches, but where those conditions hold, impact is high across confidentiality, integrity and availability with a changed scope because the attacker's authority crosses from the host user into the managed switch fabric. No public exploit code or confirmed active exploitation was identified at time of analysis. | HIGH | 8.7 | 0.3% | 44 |
No patch
|
| CVE-2026-94586 | OS command injection in the WebTools administrative interface of Brocade Fabric OS lets an authenticated, high-privileged user execute arbitrary shell commands as root on the switch by supplying crafted parameter strings during configuration download or file-transfer operations that use remote server profiles. Affected releases are Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1; exploitation is gated by two hard prerequisites, namely an account already holding the specific config-download permission (PR:H) and adjacent-network reachability to the switch management interface (AV:A), with high confidentiality, integrity, and availability impact on the device (CVSS 4.0 base 8.5). There is no public exploit code and no active exploitation identified at time of analysis, so this is a genuine but conditionally-gated risk requiring privileged management-network access rather than a remotely reachable, drop-everything emergency. | HIGH | 8.5 | 1.2% | 44 |
|