65
CVEs
0
Critical
41
High
0
KEV
2
PoC
6
Unpatched C/H
86.2%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
41
MEDIUM
22
LOW
2
Monthly CVE Trend
Affected Products (30)
Fabric Os
40
Brocade Active Support Connectivity Gateway
12
Fabric Operating System
10
Sannav
8
Debian Linux
6
H500s Firmware
5
H300s Firmware
5
H410s Firmware
5
H700s Firmware
5
Solidfire Hci Management Node
4
Cloud Backup
4
Universal Forwarder
4
Fedora
4
Curl
4
Clustered Data Ontap
4
Solidfire Hci Storage Node
4
Splunk
4
Sqlite
3
Outside In Technology
3
Sinec Infrastructure Network Services
3
Vyatta 5400 Vrouter
3
Hci Bootstrap Os
3
Brocade Sannav
3
Ubuntu Linux
3
Hci Compute Node Firmware
3
Zfs Storage Appliance Kit
3
Solidfire Enterprise Sds Hci Storage Node
3
Vyatta 5400 Vrouter Software
3
Communications Network Charging And Control
3
Network Advisor
3
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-82370 | Command injection in Brocade SANnav orchestrator versions before 3.0.1a enables network-adjacent attackers to execute arbitrary administrative Fibre Channel switch CLI commands and manipulate container runtimes, achieving high impact on confidentiality, integrity, and availability. The vendor CVSS 4.0 score is 8.6 (AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H); however, our independent assessment using CVSS 3.1 rates it 8.8 with PR:N (unauthenticated), and the description states unauthenticated while the vector indicates PR:L - authentication requirements are not confirmed from available data. No public exploit code has been identified at time of analysis, and there is no evidence of active exploitation (CISA KEV). | HIGH | 8.6 | 0.6% | 64 |
PoC
No patch
|
| CVE-2026-14443 | Incomplete log sanitization in Brocade SANnav before 3.0.1a causes extension switch IPsec pre-shared keys (PSKs) to be written in cleartext to system logs during the bulk IPsec policy collection workflow, allowing any principal with read access to container logs or exported support archives to recover those keys and potentially compromise the IPsec-protected tunnels that rely on them. The issue is local and authenticated (CVSS 3.1 AV:L/AC:L/PR:L/UI:N, confidentiality-only per independent assessment), not remotely reachable, and it is tied specifically to that diagnostic collection path rather than to arbitrary attacker input; no public exploit code has been identified at time of analysis. The 8.4 CVSS 4.0 vendor score (which also asserts high integrity impact via VI:H) should not be used as the sole triage signal, since the practical outcome depends on the attacker both holding log/support-bundle read privileges and being able to reach and reuse the leaked PSKs against the switch fabric. | HIGH | 8.4 | 0.1% | 62 |
PoC
No patch
|
| CVE-2026-87682 | Authenticated OS command injection in the management interface and session-processing routines of Brocade Fabric OS allows a low-privilege Fabric OS account - or an attacker who controls a directory-service account trusted by the switch - to smuggle shell metacharacters into connection-validation and session-verification input and reach internal execution wrappers, running arbitrary operating-system commands with elevated privileges on the SAN switch. Only Fabric OS versions before 10.0.1 are affected, and exploitation requires network reachability to the management interface over an adjacent or management network plus prior authentication (CVSS:4.0 base 8.6; the independent assessment concurs on AV:A/PR:L/UI:N with high confidentiality, integrity and availability impact). No public exploit code identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so it is best treated as an insider/lateral-movement risk on segmentation-exposed management planes rather than an opportunistic internet-facing emergency. | HIGH | 8.6 | 0.9% | 44 |
|
| CVE-2026-94581 | Brocade Fabric OS contains an OS command injection flaw in the REST API management interface that lets an authenticated, high-privileged administrator execute arbitrary commands as root on the underlying switch host by supplying shell metacharacters in SSH known-host configuration parameters. Affected deployments are Fabric OS releases before 9.2.2d and the 10.0.0 through 10.0.0a1 range; the vulnerability carries a CVSS v4.0 base score of 8.5 (High) and an equivalent CVSS v3.1 assessment of 8.5, with the practical risk tempered because an attacker must already hold administrative rights and reach the switch over an adjacent management network rather than the open Internet. No public exploit code or confirmed active exploitation was identified at time of analysis, so this is a constrained-priority issue for SAN administrators rather than an emergency patch-everything event. | HIGH | 8.5 | 1.3% | 44 |
|
| CVE-2026-82368 | Brocade SANnav deployments running versions before 3.0.1a expose backend management service ports without adequate access controls, so a local, non-administrative user on the SANnav host can talk directly to those services and relay commands to interconnected Fabric OS switches under the SANnav management user's identity. Exploitation is access-gated: it requires an authenticated low-privileged account on the host (PR:L, consistent across both the vendor CVSS 4.0 vector and our assessed CVSS:3.1 vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) plus a SANnav instance that is actively managing switches, but where those conditions hold, impact is high across confidentiality, integrity and availability with a changed scope because the attacker's authority crosses from the host user into the managed switch fabric. No public exploit code or confirmed active exploitation was identified at time of analysis. | HIGH | 8.7 | 0.3% | 44 |
No patch
|
| CVE-2026-94586 | OS command injection in the WebTools administrative interface of Brocade Fabric OS lets an authenticated, high-privileged user execute arbitrary shell commands as root on the switch by supplying crafted parameter strings during configuration download or file-transfer operations that use remote server profiles. Affected releases are Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1; exploitation is gated by two hard prerequisites, namely an account already holding the specific config-download permission (PR:H) and adjacent-network reachability to the switch management interface (AV:A), with high confidentiality, integrity, and availability impact on the device (CVSS 4.0 base 8.5). There is no public exploit code and no active exploitation identified at time of analysis, so this is a genuine but conditionally-gated risk requiring privileged management-network access rather than a remotely reachable, drop-everything emergency. | HIGH | 8.5 | 1.2% | 44 |
|
| CVE-2026-87684 | Stack-based buffer overflow in the SNMP daemon of Brocade Fabric OS (all versions before 10.0.1) lets a remote, unauthenticated attacker crash or potentially execute code on affected switches by sending a specially crafted SNMPv3 packet. The flaw sits in an internal statistics handler that copies the attacker-supplied SNMPv3 context name into a fixed-size stack buffer without validating its length, producing memory corruption that the vendor says is reachable under default configuration. Per the assessed vector (AV:A/PR:N/UI:N, C/H/I/A:H), the attacker must be on an adjacent network segment with reachability to the switch's SNMP service (UDP/161) - a materially limiting factor, since switches with SNMP isolated on a dedicated management VLAN are much harder to hit - and no authentication or user interaction is required; no public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited. | HIGH | 8.7 | 0.2% | 44 |
|
| CVE-2026-85421 | Unauthenticated control-plane takeover in the Brocade Active Support Connectivity Gateway (ASCG) HTTPS service allows a network-adjacent attacker to issue control commands, alter cluster state, and modify system configuration in every release before 3.5.0. The defect is a plain missing-authentication condition (CWE-306): no credentials, tokens, or user interaction are involved, and no non-default configuration is required, since the HTTPS control interface simply does not enforce authentication or access control on incoming requests. The principal limiting factor is reachability rather than exploit complexity - the vendor scores it CVSS 4.0 8.7 with AV:A/PR:N/UI:N (adjacent, unauthenticated, no user interaction), so the attacker must already have a foothold on the appliance's management or local network segment. No public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis, so urgency is driven by how widely the management interface is exposed on flat or loosely segmented networks. | HIGH | 8.7 | 0.2% | 44 |
|
| CVE-2026-85489 | Unauthenticated API access in Brocade ASCG (Active Support Connectivity Gateway) before version 3.5.0 lets an attacker on an adjacent network perform privileged administrative actions - reading sensitive system configuration mapping data, modifying managed device inventories, and changing operational settings - without presenting any credentials. The flaw is scored CVSS 8.7 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L) and is rooted in CWE-306, a missing authentication check for a critical function; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing). The dominant constraint is reachability rather than skill: the attacker must be able to route to the ASCG administrative management/API interface from an adjacent or logically local segment, so deployments that place the appliance behind segmentation or firewalls are materially less exposed. | HIGH | 8.7 | 0.2% | 44 |
|
| CVE-2026-87680 | Command injection in the REST API management interface of Brocade Fabric OS allows an authenticated low-privileged user to execute arbitrary operating-system commands on the affected switch, giving high confidentiality and integrity impact to the attacked system while availability is not directly affected. Only Fabric OS releases before 10.0.1 are affected, and because the CVSS vector requires adjacent-network reachability (AV:A) plus valid credentials (PR:L), the practical attack path runs through the switch management VLAN or an equivalent segmented management plane rather than the public internet. Scoring 8.5, this is a genuinely serious but not top-tier remote-exploitation risk: no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, so exposure is driven mainly by whether the REST API management interface is enabled and reachable from untrusted adjacent segments. | HIGH | 8.5 | 1.0% | 44 |
|
| CVE-2026-82369 | Command injection in the Brocade SANnav CLI scripting component lets an authenticated user who already holds command-execution/scripting permissions break out of the restricted allow-list execution context and run unauthorized shell commands across managed fabric switches, escalating to full administrative switch access. Exploitation requires a valid SANnav account with scripting rights and adjacency to the SAN management plane (AV:A, PR:L) - the product is not internet-reachable by default - and no user interaction is needed once that foothold exists. Every SANnav release before 3.0.1a is in scope per the CPE (cpe:2.3:a:brocade:sannav:*:*:*:*:*:*:*:*), and no public exploit code has been identified at time of analysis; this is a genuine mid-to-high priority for SANnav operators, not an emergency-tier internet-facing issue. | HIGH | 8.6 | 0.5% | 44 |
No patch
|
| CVE-2026-85486 | Authenticated code injection in Brocade ASCG before 3.5.0 allows network-adjacent attackers with low-privilege accounts to execute arbitrary code on the server by submitting crafted configuration form data that is evaluated before validation. The vendor CVSS 4.0 base score is 8.6 (High), and no public exploit identified at time of analysis. Exploitation requires a valid account and network adjacency, not anonymous Internet access. | HIGH | 8.6 | 0.2% | 43 |
|
| CVE-2026-85423 | Missing authentication in the Brocade ASCG data collector API endpoint allows an unauthenticated adjacent-network attacker to instruct the appliance to establish SSH connections to arbitrary hosts and execute arbitrary system commands, effectively turning it into a proxy or execution vector. Affected versions are those before 3.5.0; the vulnerability has a CVSS 4.0 score of 8.6 (AV:A/PR:N/UI:N) but requires network reachability to the service, and no public exploit identified at time of analysis. | HIGH | 8.6 | 0.2% | 43 |
|
| CVE-2026-85487 | Path traversal in the HTTP service component of Brocade Active Support Connectivity Gateway (ASCG) before 3.5.0 allows an unauthenticated attacker positioned on the same local or adjacent network segment to send a manipulated API request that escapes intended path restrictions and performs arbitrary file read or file write operations (the description also references file deletion, although the assessed impact is high confidentiality and integrity with no availability effect). The flaw is exploitable without credentials or user interaction in default configurations of affected releases, but only from an adjacent network - it is not reachable from the public internet without first obtaining such a position. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score accompanied the available intelligence. | HIGH | 8.6 | 0.2% | 43 |
|
| CVE-2026-87683 | Authenticated attackers with access to the adjacent management network can exploit stack-based buffer overflows in the REST API management component of Brocade Fabric OS versions prior to 10.0.1. By sending crafted API requests with oversized array counts or string lengths, an attacker can cause memory corruption, leading to a denial of service (daemon crash) or potentially arbitrary code execution within the management process. There is no public exploit identified at time of analysis, but the vulnerability is high severity (CVSS 8.6) and requires only low-privileged REST API credentials and network adjacency. | HIGH | 8.6 | 0.2% | 43 |
|