56
CVEs
0
Critical
35
High
0
KEV
0
PoC
0
Unpatched C/H
100.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
35
MEDIUM
19
LOW
2
Monthly CVE Trend
Affected Products (30)
Fabric Os
40
Brocade Active Support Connectivity Gateway
12
Fabric Operating System
10
Sannav
8
Debian Linux
6
H500s Firmware
5
H300s Firmware
5
H410s Firmware
5
H700s Firmware
5
Solidfire Hci Management Node
4
Cloud Backup
4
Universal Forwarder
4
Fedora
4
Curl
4
Clustered Data Ontap
4
Solidfire Hci Storage Node
4
Splunk
4
Sqlite
3
Outside In Technology
3
Sinec Infrastructure Network Services
3
Vyatta 5400 Vrouter
3
Hci Bootstrap Os
3
Brocade Sannav
3
Ubuntu Linux
3
Hci Compute Node Firmware
3
Zfs Storage Appliance Kit
3
Solidfire Enterprise Sds Hci Storage Node
3
Vyatta 5400 Vrouter Software
3
Communications Network Charging And Control
3
Network Advisor
3
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-87682 | Authenticated OS command injection in the management interface and session-processing routines of Brocade Fabric OS allows a low-privilege Fabric OS account - or an attacker who controls a directory-service account trusted by the switch - to smuggle shell metacharacters into connection-validation and session-verification input and reach internal execution wrappers, running arbitrary operating-system commands with elevated privileges on the SAN switch. Only Fabric OS versions before 10.0.1 are affected, and exploitation requires network reachability to the management interface over an adjacent or management network plus prior authentication (CVSS:4.0 base 8.6; the independent assessment concurs on AV:A/PR:L/UI:N with high confidentiality, integrity and availability impact). No public exploit code identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so it is best treated as an insider/lateral-movement risk on segmentation-exposed management planes rather than an opportunistic internet-facing emergency. | HIGH | 8.6 | 0.9% | 44 |
|
| CVE-2026-94581 | Brocade Fabric OS contains an OS command injection flaw in the REST API management interface that lets an authenticated, high-privileged administrator execute arbitrary commands as root on the underlying switch host by supplying shell metacharacters in SSH known-host configuration parameters. Affected deployments are Fabric OS releases before 9.2.2d and the 10.0.0 through 10.0.0a1 range; the vulnerability carries a CVSS v4.0 base score of 8.5 (High) and an equivalent CVSS v3.1 assessment of 8.5, with the practical risk tempered because an attacker must already hold administrative rights and reach the switch over an adjacent management network rather than the open Internet. No public exploit code or confirmed active exploitation was identified at time of analysis, so this is a constrained-priority issue for SAN administrators rather than an emergency patch-everything event. | HIGH | 8.5 | 1.3% | 44 |
|
| CVE-2026-94586 | OS command injection in the WebTools administrative interface of Brocade Fabric OS lets an authenticated, high-privileged user execute arbitrary shell commands as root on the switch by supplying crafted parameter strings during configuration download or file-transfer operations that use remote server profiles. Affected releases are Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1; exploitation is gated by two hard prerequisites, namely an account already holding the specific config-download permission (PR:H) and adjacent-network reachability to the switch management interface (AV:A), with high confidentiality, integrity, and availability impact on the device (CVSS 4.0 base 8.5). There is no public exploit code and no active exploitation identified at time of analysis, so this is a genuine but conditionally-gated risk requiring privileged management-network access rather than a remotely reachable, drop-everything emergency. | HIGH | 8.5 | 1.2% | 44 |
|
| CVE-2026-87684 | Stack-based buffer overflow in the SNMP daemon of Brocade Fabric OS (all versions before 10.0.1) lets a remote, unauthenticated attacker crash or potentially execute code on affected switches by sending a specially crafted SNMPv3 packet. The flaw sits in an internal statistics handler that copies the attacker-supplied SNMPv3 context name into a fixed-size stack buffer without validating its length, producing memory corruption that the vendor says is reachable under default configuration. Per the assessed vector (AV:A/PR:N/UI:N, C/H/I/A:H), the attacker must be on an adjacent network segment with reachability to the switch's SNMP service (UDP/161) - a materially limiting factor, since switches with SNMP isolated on a dedicated management VLAN are much harder to hit - and no authentication or user interaction is required; no public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited. | HIGH | 8.7 | 0.2% | 44 |
|
| CVE-2026-85421 | Unauthenticated control-plane takeover in the Brocade Active Support Connectivity Gateway (ASCG) HTTPS service allows a network-adjacent attacker to issue control commands, alter cluster state, and modify system configuration in every release before 3.5.0. The defect is a plain missing-authentication condition (CWE-306): no credentials, tokens, or user interaction are involved, and no non-default configuration is required, since the HTTPS control interface simply does not enforce authentication or access control on incoming requests. The principal limiting factor is reachability rather than exploit complexity - the vendor scores it CVSS 4.0 8.7 with AV:A/PR:N/UI:N (adjacent, unauthenticated, no user interaction), so the attacker must already have a foothold on the appliance's management or local network segment. No public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis, so urgency is driven by how widely the management interface is exposed on flat or loosely segmented networks. | HIGH | 8.7 | 0.2% | 44 |
|
| CVE-2026-85489 | Unauthenticated API access in Brocade ASCG (Active Support Connectivity Gateway) before version 3.5.0 lets an attacker on an adjacent network perform privileged administrative actions - reading sensitive system configuration mapping data, modifying managed device inventories, and changing operational settings - without presenting any credentials. The flaw is scored CVSS 8.7 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L) and is rooted in CWE-306, a missing authentication check for a critical function; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing). The dominant constraint is reachability rather than skill: the attacker must be able to route to the ASCG administrative management/API interface from an adjacent or logically local segment, so deployments that place the appliance behind segmentation or firewalls are materially less exposed. | HIGH | 8.7 | 0.2% | 44 |
|
| CVE-2026-87680 | Command injection in the REST API management interface of Brocade Fabric OS allows an authenticated low-privileged user to execute arbitrary operating-system commands on the affected switch, giving high confidentiality and integrity impact to the attacked system while availability is not directly affected. Only Fabric OS releases before 10.0.1 are affected, and because the CVSS vector requires adjacent-network reachability (AV:A) plus valid credentials (PR:L), the practical attack path runs through the switch management VLAN or an equivalent segmented management plane rather than the public internet. Scoring 8.5, this is a genuinely serious but not top-tier remote-exploitation risk: no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, so exposure is driven mainly by whether the REST API management interface is enabled and reachable from untrusted adjacent segments. | HIGH | 8.5 | 1.0% | 44 |
|
| CVE-2026-85486 | Authenticated code injection in Brocade ASCG before 3.5.0 allows network-adjacent attackers with low-privilege accounts to execute arbitrary code on the server by submitting crafted configuration form data that is evaluated before validation. The vendor CVSS 4.0 base score is 8.6 (High), and no public exploit identified at time of analysis. Exploitation requires a valid account and network adjacency, not anonymous Internet access. | HIGH | 8.6 | 0.2% | 43 |
|
| CVE-2026-85423 | Missing authentication in the Brocade ASCG data collector API endpoint allows an unauthenticated adjacent-network attacker to instruct the appliance to establish SSH connections to arbitrary hosts and execute arbitrary system commands, effectively turning it into a proxy or execution vector. Affected versions are those before 3.5.0; the vulnerability has a CVSS 4.0 score of 8.6 (AV:A/PR:N/UI:N) but requires network reachability to the service, and no public exploit identified at time of analysis. | HIGH | 8.6 | 0.2% | 43 |
|
| CVE-2026-85487 | Path traversal in the HTTP service component of Brocade Active Support Connectivity Gateway (ASCG) before 3.5.0 allows an unauthenticated attacker positioned on the same local or adjacent network segment to send a manipulated API request that escapes intended path restrictions and performs arbitrary file read or file write operations (the description also references file deletion, although the assessed impact is high confidentiality and integrity with no availability effect). The flaw is exploitable without credentials or user interaction in default configurations of affected releases, but only from an adjacent network - it is not reachable from the public internet without first obtaining such a position. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score accompanied the available intelligence. | HIGH | 8.6 | 0.2% | 43 |
|
| CVE-2026-87683 | Authenticated attackers with access to the adjacent management network can exploit stack-based buffer overflows in the REST API management component of Brocade Fabric OS versions prior to 10.0.1. By sending crafted API requests with oversized array counts or string lengths, an attacker can cause memory corruption, leading to a denial of service (daemon crash) or potentially arbitrary code execution within the management process. There is no public exploit identified at time of analysis, but the vulnerability is high severity (CVSS 8.6) and requires only low-privileged REST API credentials and network adjacency. | HIGH | 8.6 | 0.2% | 43 |
|
| CVE-2026-87424 | Authentication bypass in Brocade ASCG versions prior to 3.5.0 allows unauthenticated attackers on an adjacent network to fully compromise the SupportLink API component due to a hard-coded cryptographic key (CWE-321) shared across all deployments. Exploitation requires adjacent network access and recovery of the key, but no public exploit code has been identified at time of analysis. The vendor has released version 3.5.0 to address the flaw. | HIGH | 8.6 | 0.2% | 43 |
|
| CVE-2026-87687 | An authenticated, low-privileged user in one Virtual Fabric on a Brocade Fabric OS switch can submit a request carrying an arbitrary fabric identifier that is never validated against the caller's authorization scope, allowing unauthorized cross-fabric operations and disclosure of configuration details belonging to tenants or Virtual Fabrics they were not granted access to. Affected builds are Fabric OS releases before 9.2.2d and 10.0.0 through 10.0.0a1, and exploitation requires an adjacent/management-network position (AV:A) plus valid credentials (PR:L) in an environment where multiple tenants actually share the switch; single-fabric deployments with no tenant separation offer nothing to cross into. Impact is confined to confidentiality and integrity of other fabrics' configuration with no availability effect, and there is no public exploit identified at time of analysis and no CISA KEV listing. | HIGH | 8.5 | 0.2% | 43 |
|
| CVE-2026-87679 | Heap corruption in Brocade Fabric OS before 10.0.1 allows an authenticated administrator to crash a SAN switch's management service or potentially achieve arbitrary code execution by sending a crafted trunk configuration request through the REST API that is padded with an excessive number of list delimiters. The affected code path copies delimiter-separated list strings into a dynamically allocated heap array without validating the maximum number of elements, so a request that overruns the allocation corrupts heap metadata. Exploitation requires high-level (administrator) credentials and adjacent-network reachability to the management interface - a combination that realistically narrows the threat population to malicious insiders or attackers already holding or abusing admin credentials - and no public exploit code has been identified at time of analysis. This is a genuine but conditional priority rather than a drop-everything emergency. | HIGH | 8.5 | 0.2% | 43 |
|
| CVE-2026-87664 | Authentication bypass in Brocade Fabric OS 9.2.2d and 10.0.0 through 10.0.0a1 allows a local low-privileged process to forge IPC storage callbacks and register an administrative web-management session without legitimate authentication. The flaw is CWE-306 (missing authentication for a critical function) and has a high severity score (CVSS 8.5, v4.0 AV:L/PR:L), but exploitation requires an existing local foothold on the switch rather than network access. No public exploit or KEV confirmation was identified at time of analysis. | HIGH | 8.5 | 0.1% | 43 |
|