FO
Product
Fabric Operating System
On CISA KEVExploited in the wild
146
CVEs
2
On KEV
9.8
Max CVSS
43
New 30D
Severity mix
Critical 11High 68Medium 60Low 6
Watch
Add Fabric Operating System to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-6436 | 7.8 | Nov 8 | A Vulnerability in the firmwaredownload command of Brocade Fabric OS command line interface (CLI) versions before 8.2.1, 8.1.2f, 8.0.2f, 7.4.2d could allow a local attacker to… Affected: 7.4.2 before 7.4.2d; 8.0.2 before 8.0.2f; 8.1.2 before 8.1.2f; 8.2.0 before 8.2.1 |
| CVE-2018-6441 | 7.8 | Nov 8 | A vulnerability in Secure Shell implementation of Brocade Fabric OS versions before 8.2.1, 8.1.2f, 8.0.2f, 7.4.2d could allow a local attacker to provide arbitrary environment… Affected: 7.4.2 before 7.4.2d; 8.0.2 before 8.0.2f; 8.1.2 before 8.1.2f; 8.2.0 before 8.2.1 |
| CVE-2018-6435 | 7.8 | Nov 8 | A Vulnerability in the secryptocfg command of Brocade Fabric OS command line interface (CLI) versions before 8.2.1, 8.1.2f, 8.0.2f, 7.4.2d could allow a local attacker to escape… Affected: 7.4.2 before 7.4.2d; 8.0.2 before 8.0.2f; 8.1.2 before 8.1.2f; 8.2.0 before 8.2.1 |
| CVE-2026-87665 | 7.5 | Oct 8 | A stack-based buffer overflow vulnerability exists in the Internet Key Exchange (IKEv2) protocol handler on Brocade Fabric OS versions before 10.0.1 Affected: before 10.0.1 |
| CVE-2026-87671 | 7.5 | Oct 8 | An out-of-bounds memory read vulnerability exists in the web management daemon of Brocade Fabric OS versions before 10.0.1 Affected: before 10.0.1 |
| CVE-2024-5462 | 7.5 | Feb 14 | Brocade Fabric OS may capture SNMP Passwords in clear text Affected: before 9.2.0 |
| CVE-2024-10403 | 7.5 | Nov 21 | SFTP/FTP password could be captured in plain text in Supportsave generated from SANnav Affected: before 9.2.0c1; 9.2.1 before 9.2.1a1 |
| CVE-2023-3489 | 7.5 | Aug 31 | The firmwaredownload command on Brocade Fabric OS v9.2.0 could log the FTP/SFTP/SCP server password in clear text in the SupportSave file when performing a downgrade from… Affected: 9.2.0 |
| CVE-2022-27775 | 7.5 | Jun 1 | An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the connection pool but with a different zone id… Affected: All versions, or not specified |
| CVE-2020-15383 | 7.5 | Jun 9 | Running security scans against the SAN switch can cause config and secnotify processes within the firmware before Brocade Fabric OS v9.0.0, v8.2.2d and v8.2.1e to consume all… Affected: before 8.2.1; 8.2.1; 8.2.1a; 8.2.1b; 8.2.1c; 8.2.1d; +3 more |
| CVE-2018-6448 | 7.5 | Sep 25 | A vulnerability in the management interface in Brocade Fabric OS Versions before Brocade Fabric OS v9.0.0 could allow a remote attacker to perform a denial of service attack on… Affected: before 9.0.0 |
| CVE-2020-1967 | 7.5 | Apr 21 | Segmentation fault in SSL_check_chain Affected: All versions, or not specified |
| CVE-2019-16204 | 7.5 | Feb 5 | Brocade Fabric OS Versions before v7.4.2f, v8.2.2a, v8.1.2j and v8.2.1d could expose external passwords, common secrets or authentication keys used between the switch and an… Affected: before 7.4.2f; 8.1.2 before 8.1.2j; 8.2.1 before 8.2.1d; 8.2.2 before 8.2.2a |
| CVE-2019-16203 | 7.5 | Feb 5 | Brocade Fabric OS Versions before v8.2.2a and v8.2.1d could expose the credentials of the remote ESRS server when these credentials are given as a command line option when… Affected: 8.2.1 before 8.2.1d; 8.2.2 before 8.2.2a |
| CVE-2019-19069 | 7.5 | Nov 18 | A memory leak in the fastrpc_dma_buf_attach() function in drivers/misc/fastrpc.c in the Linux kernel before 5.3.9 allows attackers to cause a denial of service (memory… Affected: All versions, or not specified |
| CVE-2019-19050 | 7.5 | Nov 18 | A memory leak in the crypto_reportstat() function in crypto/crypto_user_stat.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory… Affected: All versions, or not specified |
| CVE-2018-6434 | 7.5 | Nov 8 | A vulnerability in the web management interface of Brocade Fabric OS versions before 8.2.1, 8.1.2f, 8.0.2f, 7.4.2d could allow attackers to intercept or manipulate a user's… Affected: 7.4.2 before 7.4.2d; 8.0.2 before 8.0.2f; 8.1.2 before 8.1.2f; 8.2.0 before 8.2.1 |
| CVE-2020-15387 | 7.4 | Jun 9 | The host SSH servers of Brocade Fabric OS before Brocade Fabric OS v7.4.2h, v8.2.1c, v8.2.2, v9.0.0, and Brocade SANnav before v2.1.1 utilize keys of less than 2048 bits, which… Affected: before 7.4.2; 8.2.0 before 8.2.1; 7.4.2; 7.4.2a; 7.4.2b; 7.4.2c; +6 more |
| CVE-2020-15778 | 7.4 | Jul 24 | scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument Affected: All versions, or not specified |
| CVE-2026-87687 | 7.3 | Oct 8 | An authorization and input validation vulnerability exists in Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 Affected: before 9.2.2d; 10.0.0 before 10.0.1 |
| CVE-2023-38709 | 7.3 | Apr 4 | Apache HTTP Server: HTTP response splitting Affected: All versions, or not specified |
| CVE-2026-87673 | 7.2 | Oct 8 | An OS command injection vulnerability exists in maintenance command-line diagnostic utilities on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 Affected: before 9.2.2d; 10.0.0 before 10.0.1 |
| CVE-2026-87679 | 7.2 | Oct 8 | When Brocade Fabric OS versions before 10.0.1 processes trunk configuration operations, the application parses user-supplied list strings into dynamically allocated heap arrays… Affected: before 10.0.1 |
| CVE-2025-58383 | 7.2 | Feb 3 | Privilege escalation via bind command in Brocade Fabric OS Affected: before 9.2.1c2; 9.2.2 before 9.2.2b |
| CVE-2025-58382 | 7.2 | Feb 3 | Privilege escalation in Brocade Fabric before 9.2.1c2 and 9.2.2 through 9.2.2a Affected: before 9.2.1c2; 9.2.2 before 9.2.2b |
| CVE-2022-33178 | 7.2 | Oct 25 | A vulnerability in the radius authentication system of Brocade Fabric OS before Brocade Fabric OS 9.0 could allow a remote attacker to execute arbitrary code on the Brocade switch Affected: before 9.0.0 |
| CVE-2026-87660 | 7.1 | Oct 8 | An improper file permission and missing authorization vulnerability exists in the diagnostic kernel module subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through… Affected: before 9.2.2d; 10.0.0 before 10.0.1 |
| CVE-2024-7516 | 7.1 | Nov 12 | Brocade Fabric OS before 9.2.2 does not enforce strict host key checking Affected: before 9.2.2 |
| CVE-2020-13630 | 7.0 | May 27 | ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature Affected: All versions, or not specified |
| CVE-2019-18683 | 7.0 | Nov 4 | An issue was discovered in drivers/media/platform/vivid in the Linux kernel through 5.3.8 Affected: All versions, or not specified |
| CVE-2026-94586 | 6.8 | Oct 8 | A command injection vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operations of Brocade Fabric OS versions before… Affected: before 9.2.2d; 10.0.0 before 10.0.1 |
| CVE-2026-94581 | 6.8 | Oct 8 | An OS command injection vulnerability exists in the REST API management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 allows an authenticated,… Affected: before 9.2.2d; 10.0.0 before 10.0.1 |
| CVE-2026-87675 | 6.8 | Oct 8 | An OS command injection vulnerability exists in the configuration management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 Affected: before 9.2.2d; 10.0.0 before 10.0.1 |
| CVE-2026-87685 | 6.8 | Oct 8 | An arbitrary file manipulation vulnerability exists in the WebTools management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 Affected: before 9.2.2d; 10.0.0 before 10.0.1 |
| CVE-2026-87688 | 6.8 | Oct 8 | An input validation vulnerability exists in the security certificate management component of the Brocade Fabric OS administrative management API Affected: before 9.2.2d; 10.0.0 before 10.0.1 |
| CVE-2026-87663 | 6.7 | Oct 8 | An authentication bypass and command injection vulnerability exists in the inter-switch remote execution service of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through… Affected: before 9.2.2d; 10.0.0 before 10.0.1 |
| CVE-2026-87662 | 6.7 | Oct 8 | Brocade Fabric versions before 9.2.2d and 10.0.0 through 10.0.0a1 handling of specific download protocols utilizes unsanitized parameter strings Affected: before 9.2.2d; 10.0.0 before 10.0.1 |
| CVE-2020-15375 | 6.7 | Dec 11 | Brocade Fabric OS versions before v9.0.0, v8.2.2c, v8.2.1e, v8.1.2k, v8.2.0_CBN3, v7.4.2g contain an improper input validation weakness in the command line interface when… Affected: before 7.4.2g; 8.0.0 before 8.1.2k; 8.2.0 before 8.2.0_cbn3; 8.2.1 before 8.2.1e; 8.2.2b before 8.2.2c |
| CVE-2026-87677 | 6.6 | Oct 8 | An OS command injection vulnerability exists in the account management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 Affected: before 9.2.2d; 10.0.0 before 10.0.1 |
| CVE-2026-87668 | 6.5 | Oct 8 | A stack-based buffer overflow vulnerability exists in the diagnostic execution utility of Brocade Fabric OS versions before 10.0.1 Affected: before 10.0.1 |
| CVE-2023-31426 | 6.5 | Aug 1 | The Brocade Fabric OS Commands “configupload” and “configdownload” before Brocade Fabric OS v9.1.1c, v8.2.3d, v9.2.0 print scp, sftp, ftp servers passwords in supportsave Affected: before 8.2.3d; 9.0.0 before 9.1.1c |
| CVE-2022-28170 | 6.5 | Oct 25 | Brocade Fabric OS Web Application services before Brocade Fabric v9.1.0, v9.0.1e, v8.2.3c, v7.4.2j store server and user passwords in the debug statements Affected: before 7.4.2j; 8.0.0 before 8.2.3c; 9.0.0 before 9.0.1e; 9.1.0 |
| CVE-2022-27776 | 6.5 | Jun 1 | A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host but another port… Affected: All versions, or not specified |
| CVE-2021-27789 | 6.5 | Mar 18 | The Web application of Brocade Fabric OS before versions Brocade Fabric OS v9.0.1a and v8.2.3a contains debug statements that expose sensitive information to the program's… Affected: before 8.2.3a; 9.0.0 before 9.0.1a |
| CVE-2020-15388 | 6.5 | Mar 18 | A vulnerability in the Brocade Fabric OS before Brocade Fabric OS v9.0.1a, v8.2.3, v8.2.0_CBN4, and v7.4.2h could allow an authenticated CLI user to abuse the history command to… Affected: before 7.4.2h; 9.0.0 before 9.0.1a; 8.2.0; 8.2.0; 8.2.0a; 8.2.3 |
| CVE-2021-27796 | 6.5 | Feb 21 | A vulnerability in Brocade Fabric OS versions before Brocade Fabric OS v8.0.1b, v7.4.1d could allow an authenticated attacker within the restricted shell environment (rbash) as… Affected: before 7.4.1d; 8.0.0 before 8.0.1b |
| CVE-2020-15370 | 6.5 | Sep 25 | Brocade Fabric OS versions before Brocade Fabric OS v7.4.2g could allow an authenticated, remote attacker to view a user password in cleartext Affected: before 7.4.2g |
| CVE-2020-13645 | 6.5 | May 28 | In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verification of the server's TLS certificate if the application fails to specify… Affected: All versions, or not specified |
| CVE-2017-6227 | 6.5 | Feb 8 | A vulnerability in the IPv6 stack on Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) versions before 7.4.2b, 8.1.2 and 8.2.0 could allow an attacker to cause a… Affected: before 7.4.2b; 8.0.0; 8.0.1; 8.0.2; 8.1.0; 8.1.1; +1 more |
| CVE-2016-4376 | 6.5 | Aug 22 | HPE FOS before 7.4.1d and 8.x before 8.0.1 on StoreFabric B switches allows remote attackers to obtain sensitive information via unspecified vectors Affected: through 7.4.1; 8.0.0 |