FO
Product
Fabric OS
On CISA KEVExploited in the wild
62
CVEs
1
On KEV
9.8
Max CVSS
43
New 30D
Severity mix
Critical 3High 26Medium 28Low 5
Watch
Add Fabric OS to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-1976 In wildKEV | 6.7 | Apr 24 | Code injection exposure in Fabric OS 9.1.0 through 9.1.1d6 Affected: Fabric OS versions 9.1.0 through 9.1.1d6 |
| CVE-2026-87659 | 9.8 | Oct 8 | A critical authorization bypass vulnerability exists in the Management Server handling of Brocade Fabric OS versions before 10.0.1 Affected: before 10.0.1 |
| CVE-2026-87684 | 9.8 | Oct 8 | A stack-based buffer overflow vulnerability exists in the SNMP daemon request handling of Brocade Fabric versions before 10.0.1 Affected: before 10.0.1 |
| CVE-2023-3454 | 9.8 | Apr 4 | Remote code execution (RCE) vulnerability in Brocade Fabric OS after v9.0 and before v9.2.0 could allow an attacker to execute arbitrary code and use this to gain root access to… Affected: after v9.0 and before v9.2.0 |
| CVE-2026-94585 | 8.8 | Oct 8 | An authentication bypass vulnerability exists in the web management interface of Brocade Fabric OS versions before 9.2.2d running on the MXG610 platform Affected: before 9.2.2d |
| CVE-2026-94578 | 8.8 | Oct 8 | Brocade Fabric OS versions before 10.0.1 contain an authorization logic vulnerability in the AAA (Authentication, Authorization, and Accounting) integration framework allows… Affected: before 10.0.1 |
| CVE-2026-87683 | 8.8 | Oct 8 | Multiple stack-based buffer overflow vulnerabilities exist in the REST API management component of Brocade Fabric OS versions prior to 10.0.1 Affected: before 10.0.1 |
| CVE-2026-87682 | 8.8 | Oct 8 | Multiple OS Command Injection vulnerabilities exist in the management interface and session processing routines of Brocade Fabric OS versions before 10.0.1 Affected: before 10.0.1 |
| CVE-2026-87680 | 8.8 | Oct 8 | A command injection vulnerability in the REST API management interface of Brocade Fabric OS versions before 10.0.1 allows an authenticated user to execute arbitrary system… Affected: before 10.0.1 |
| CVE-2024-5460 | 8.1 | Jun 25 | Brocade Fabric OS versions prior to v9.0 have default community strings Affected: prior to v9.0.0 |
| CVE-2026-94579 | 8.0 | Oct 8 | An OS command injection vulnerability exists in the PAM (Pluggable Authentication Module) session cleanup routines during SSH session termination on Brocade Fabric OS versions… Affected: before 9.2.2d; 10.0.0 through 10.0.0a1 |
| CVE-2026-94576 | 8.0 | Oct 8 | An authentication logic and privilege escalation vulnerability exists in the account management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 Affected: before 9.2.2d; 10.0.0 through 10.0.0a1 |
| CVE-2026-87666 | 8.0 | Oct 8 | An OS command injection vulnerability exists in the time and zone management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 Affected: before 9.2.2d; 10.0.0 through 10.0.0a1 |
| CVE-2026-94577 | 7.8 | Oct 8 | A privilege escalation vulnerability exists in the internal Command-Line Interface (CLI) authorization handling mechanism of Brocade Fabric OS versions before 9.2.2d and 10.0.0… Affected: before 9.2.2d; 10.0.0 through 10.0.0a1 |
| CVE-2026-87664 | 7.8 | Oct 8 | A session context forgery vulnerability exists in the web management daemon of Brocade Fabric OS versions 9.2.2d and 10.0.0 through 10.0.0a1 Affected: before 9.2.2d; 10.0.0 through 10.0.0a1 |
| CVE-2026-87674 | 7.8 | Oct 8 | A local privilege escalation vulnerability exists in the system logging daemon of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 Affected: before 9.2.2d; 10.0.0 through 10.0.0a1 |
| CVE-2026-94582 | 7.8 | Oct 8 | A memory buffer overflow vulnerability exists in the internal diagnostic and route validation routines used by the Fabric Shortest Path First (FSPF) protocol component of Brocade… Affected: before 10.0.1 |
| CVE-2025-9711 | 7.8 | Feb 3 | Privilege escalation in Brocade Fabric OS before 9.2.1c3, and 9.2.2 though 9.2.2b Affected: before 9.2.1c3, and 9.2.2 though 9.2.2b |
| CVE-2026-0383 | 7.8 | Feb 3 | Information disclosure in Brocade Fabric OS before 9.2.1c2, 9.2.2 through 9.2.2a and 10.0.0 Affected: before 9.2.1c2, 9.2.2 through 9.2.2a and 10.0.0 |
| CVE-2024-7517 | 7.8 | Nov 21 | Privileged escalation via crafted use of portcfg command Affected: Brocade Fabric OS versions before 9.2.0c, and 9.2.1 through 9.2.1a |
| CVE-2026-87665 | 7.5 | Oct 8 | A stack-based buffer overflow vulnerability exists in the Internet Key Exchange (IKEv2) protocol handler on Brocade Fabric OS versions before 10.0.1 Affected: before 10.0.1 |
| CVE-2026-87671 | 7.5 | Oct 8 | An out-of-bounds memory read vulnerability exists in the web management daemon of Brocade Fabric OS versions before 10.0.1 Affected: before 10.0.1 |
| CVE-2024-10403 | 7.5 | Nov 21 | SFTP/FTP password could be captured in plain text in Supportsave generated from SANnav Affected: Brocade Fabric OS versions before 8.2.3e2, versions 9.0.0 through 9.2.0c, and 9.2.1 through 9.2.1a |
| CVE-2026-87687 | 7.3 | Oct 8 | An authorization and input validation vulnerability exists in Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 Affected: before 9.2.2d; 10.0.0 through 10.0.0a1 |
| CVE-2026-87673 | 7.2 | Oct 8 | An OS command injection vulnerability exists in maintenance command-line diagnostic utilities on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 Affected: before 9.2.2d; 10.0.0 through 10.0.0a1 |
| CVE-2026-87679 | 7.2 | Oct 8 | When Brocade Fabric OS versions before 10.0.1 processes trunk configuration operations, the application parses user-supplied list strings into dynamically allocated heap arrays… Affected: before 10.0.1 |
| CVE-2025-58383 | 7.2 | Feb 3 | Privilege escalation via bind command in Brocade Fabric OS Affected: before 9.2.1c2 |
| CVE-2025-58382 | 7.2 | Feb 3 | Privilege escalation in Brocade Fabric before 9.2.1c2 and 9.2.2 through 9.2.2a Affected: before 9.2.1c2 and 9.2.2 through 9.2.2a |
| CVE-2026-87660 | 7.1 | Oct 8 | An improper file permission and missing authorization vulnerability exists in the diagnostic kernel module subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through… Affected: before 9.2.2d; 10.0.0 through 10.0.0a1 |
| CVE-2024-7516 | 7.1 | Nov 12 | Brocade Fabric OS before 9.2.2 does not enforce strict host key checking Affected: before 9.2.2 |
| CVE-2026-94586 | 6.8 | Oct 8 | A command injection vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operations of Brocade Fabric OS versions before… Affected: before 9.2.2d; 10.0.0 through 10.0.0a1 |
| CVE-2026-94581 | 6.8 | Oct 8 | An OS command injection vulnerability exists in the REST API management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 allows an authenticated,… Affected: before 9.2.2d; 10.0.0 through 10.0.0a1 |
| CVE-2026-87675 | 6.8 | Oct 8 | An OS command injection vulnerability exists in the configuration management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 Affected: before 9.2.2d; 10.0.0 through 10.0.0a1 |
| CVE-2026-87685 | 6.8 | Oct 8 | An arbitrary file manipulation vulnerability exists in the WebTools management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 Affected: before 9.2.2d; 10.0.0 through 10.0.0a1 |
| CVE-2026-87688 | 6.8 | Oct 8 | An input validation vulnerability exists in the security certificate management component of the Brocade Fabric OS administrative management API Affected: before 9.2.2d; 10.0.0 through 10.0.0a1 |
| CVE-2026-87663 | 6.7 | Oct 8 | An authentication bypass and command injection vulnerability exists in the inter-switch remote execution service of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through… Affected: before 9.2.2d; 10.0.0 through 10.0.0a1 |
| CVE-2026-87662 | 6.7 | Oct 8 | Brocade Fabric versions before 9.2.2d and 10.0.0 through 10.0.0a1 handling of specific download protocols utilizes unsanitized parameter strings Affected: before 9.2.2d; 10.0.0 through 10.0.0a1 |
| CVE-2026-87677 | 6.6 | Oct 8 | An OS command injection vulnerability exists in the account management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 Affected: before 9.2.2d; 10.0.0 through 10.0.0a1 |
| CVE-2026-87668 | 6.5 | Oct 8 | A stack-based buffer overflow vulnerability exists in the diagnostic execution utility of Brocade Fabric OS versions before 10.0.1 Affected: before 10.0.1 |
| CVE-2017-6227 | 6.5 | Feb 8 | A vulnerability in the IPv6 stack on Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) versions before 7.4.2b, 8.1.2 and 8.2.0 could allow an attacker to cause a… Affected: 8.0.2b2 |
| CVE-2026-87681 | 6.3 | Oct 8 | An Access Control Bypass vulnerability exists in the Role-Based Access Control (RBAC) validation engine of Brocade Fabric OS versions before 10.0.1 Affected: before 10.0.1 |
| CVE-2017-6225 | 6.1 | Feb 8 | Cross-site scripting (XSS) vulnerability in the web-based management interface of Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) versions before 7.4.2b, 8.1.2… Affected: 8.0.1b1; 8.0.2b1; 8.1.0c1 |
| CVE-2026-87661 | 5.7 | Oct 8 | Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 directly accepts Apache configuration file data during service setup or re-initialization Affected: before 9.2.2d; 10.0.0 through 10.0.0a1 |
| CVE-2026-94575 | 5.7 | Oct 8 | A logic vulnerability in Brocade Fabric OS versions before 10.0.1 web management framework allows an authenticated, low-privileged user to bypass inner Role-Based Access Control… Affected: before 10.0.1 |
| CVE-2026-87676 | 5.7 | Oct 8 | A stack-based buffer overflow vulnerability exists in the security library component of Brocade Fabric OS versions before 10.0.1 Affected: before 10.0.1 |
| CVE-2026-87672 | 5.5 | Oct 8 | An information disclosure vulnerability exists in the SupportLink diagnostic collection utilities of Brocade Fabric OS versions before 10.0.1 Affected: before 10.0.1 |
| CVE-2025-58379 | 5.5 | Feb 3 | Password Exposure in Brocade Fabric OS Affected: before 9.2.1 |
| CVE-2024-29954 | 5.5 | Jun 25 | password management API prints sensitive information in log files Affected: before v9.2.1, v9.2.0b, v9.1.1d, and v8.2.3e |
| CVE-2026-87678 | 5.2 | Oct 8 | An input validation and output encoding vulnerability exists in the web management interface of Brocade Fabric OS versions before 10.0.1 Affected: before 10.0.1 |
| CVE-2026-94587 | 4.5 | Oct 8 | A buffer overflow vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operations of Brocade Fabric OS versions before… Affected: before 9.2.2d; 10.0.0 through 10.0.0a1 |