Brocade Fabric OS
71 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-94585 | < 9.2.2d | An authentication bypass vulnerability exists in the web management interface of Brocade Fabric OS versions before 9.2.2d running on the MXG | HIGH 7.7 | 0.2 % | ||
| CVE-2026-94587 | < 9.2.2d ; 10.0.0 – 10.0.0a1 | A buffer overflow vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operations | MEDIUM 6.9 | 0.2 % | ||
| CVE-2026-94579 | < 9.2.2d ; 10.0.0 – 10.0.0a1 | An OS command injection vulnerability exists in the PAM (Pluggable Authentication Module) session cleanup routines during SSH session termin | MEDIUM 5.4 | 3.1 % | ||
| CVE-2026-94576 | < 9.2.2d ; 10.0.0 – 10.0.0a1 | An authentication logic and privilege escalation vulnerability exists in the account management interface of Brocade Fabric OS versions befo | MEDIUM 5.9 | 0.4 % | ||
| CVE-2026-87661 | < 9.2.2d ; 10.0.0 – 10.0.0a1 | Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 directly accepts Apache configuration file data during service setup or | MEDIUM 6.8 | 0.2 % | ||
| CVE-2026-87677 | < 9.2.2d ; 10.0.0 – 10.0.0a1 | An OS command injection vulnerability exists in the account management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 thro | MEDIUM 5.4 | 0.6 % | ||
| CVE-2026-94586 | < 9.2.2d ; 10.0.0 – 10.0.0a1 | A command injection vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operation | HIGH 8.5 | 1.4 % | ||
| CVE-2026-94581 | < 9.2.2d ; 10.0.0 – 10.0.0a1 | An OS command injection vulnerability exists in the REST API management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 thr | HIGH 8.5 | 1.5 % | ||
| CVE-2026-94577 | < 9.2.2d ; 10.0.0 – 10.0.0a1 | A privilege escalation vulnerability exists in the internal Command-Line Interface (CLI) authorization handling mechanism of Brocade Fabric | HIGH 7.3 | 0.1 % | ||
| CVE-2026-87664 | < 9.2.2d ; 10.0.0 – 10.0.0a1 | A session context forgery vulnerability exists in the web management daemon of Brocade Fabric OS versions 9.2.2d and 10.0.0 through 10.0.0a1 | HIGH 8.5 | 0.1 % | ||
| CVE-2026-87663 | < 9.2.2d ; 10.0.0 – 10.0.0a1 | An authentication bypass and command injection vulnerability exists in the inter-switch remote execution service of Brocade Fabric OS versio | HIGH 7.1 | 0.7 % | ||
| CVE-2026-87662 | < 9.2.2d ; 10.0.0 – 10.0.0a1 | Brocade Fabric versions before 9.2.2d and 10.0.0 through 10.0.0a1 handling of specific download protocols utilizes unsanitized parameter str | HIGH 7.0 | 0.3 % | ||
| CVE-2026-87660 | < 9.2.2d ; 10.0.0 – 10.0.0a1 | An improper file permission and missing authorization vulnerability exists in the diagnostic kernel module subsystem of Brocade Fabric OS ve | HIGH 7.0 | 0.1 % | ||
| CVE-2026-87667 | < 9.2.2d ; 10.0.0 – 10.0.0a1 | An argument injection vulnerability exists in the configuration management command-line utility of Brocade Fabric OS versions before 9.2.2d | HIGH 8.4 | 0.2 % | ||
| CVE-2026-87666 | < 9.2.2d ; 10.0.0 – 10.0.0a1 | An OS command injection vulnerability exists in the time and zone management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0. | HIGH 8.6 | 2.6 % | ||
| CVE-2026-87675 | < 9.2.2d ; 10.0.0 – 10.0.0a1 | An OS command injection vulnerability exists in the configuration management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0. | HIGH 7.3 | 0.7 % | ||
| CVE-2026-87674 | < 9.2.2d ; 10.0.0 – 10.0.0a1 | A local privilege escalation vulnerability exists in the system logging daemon of Brocade Fabric OS versions before 9.2.2d and 10.0.0 throug | HIGH 8.5 | 0.1 % | ||
| CVE-2026-87673 | < 9.2.2d ; 10.0.0 – 10.0.0a1 | An OS command injection vulnerability exists in maintenance command-line diagnostic utilities on Brocade Fabric OS versions before 9.2.2d an | HIGH 7.0 | 1.8 % | ||
| CVE-2026-87687 | < 9.2.2d ; 10.0.0 – 10.0.0a1 | An authorization and input validation vulnerability exists in Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authe | HIGH 8.5 | 0.2 % | ||
| CVE-2026-87685 | < 9.2.2d ; 10.0.0 – 10.0.0a1 | An arbitrary file manipulation vulnerability exists in the WebTools management interface of Brocade Fabric OS versions before 9.2.2d and 10. | HIGH 8.4 | 0.2 % | ||
| CVE-2026-87688 | < 9.2.2d ; 10.0.0 – 10.0.0a1 | An input validation vulnerability exists in the security certificate management component of the Brocade Fabric OS administrative management | HIGH 8.5 | 0.1 % | ||
| CVE-2026-94584 | < 10.0.1 | A race condition and thread-safety vulnerability exists in the web management daemon of Brocade Fabric OS versions before 10.0.1. When handl | LOW 2.1 | 0.1 % | ||
| CVE-2026-94580 | < 10.0.1 | An arbitrary file and directory deletion vulnerability exists in the REST API management interface handling USB storage operations on Brocad | MEDIUM 5.7 | 0.2 % | ||
| CVE-2026-94575 | < 10.0.1 | A logic vulnerability in Brocade Fabric OS versions before 10.0.1 web management framework allows an authenticated, low-privileged user to b | MEDIUM 6.9 | 0.2 % | ||
| CVE-2026-94583 | < 10.0.1 | A race condition vulnerability exists in the request processing logic of the REST management interface on Brocade Fabric OS versions before | LOW 2.1 | 0.1 % | ||
| CVE-2026-94582 | < 10.0.1 | A memory buffer overflow vulnerability exists in the internal diagnostic and route validation routines used by the Fabric Shortest Path Firs | MEDIUM 6.8 | 0.1 % | ||
| CVE-2026-87668 | < 10.0.1 | A stack-based buffer overflow vulnerability exists in the diagnostic execution utility of Brocade Fabric OS versions before 10.0.1. When pro | MEDIUM 6.9 | 0.4 % | ||
| CVE-2026-87665 | < 10.0.1 | A stack-based buffer overflow vulnerability exists in the Internet Key Exchange (IKEv2) protocol handler on Brocade Fabric OS versions befor | MEDIUM 6.0 | 0.8 % | ||
| CVE-2026-87672 | < 10.0.1 | An information disclosure vulnerability exists in the SupportLink diagnostic collection utilities of Brocade Fabric OS versions before 10.0. | MEDIUM 6.8 | 0.1 % | ||
| CVE-2026-87670 | < 10.0.1 | An authorization logic vulnerability exists in the Brocade Fabric OS versions before 10.0.1 REST API gateway. The internal gate guarding res | MEDIUM 5.1 | 0.2 % | ||
| CVE-2026-87669 | < 10.0.1 | A missing authorization check in Brocade Fabric OS versions before 10.0.1 REST API interface of affected platform releases allows an authent | MEDIUM 5.1 | 0.2 % | ||
| CVE-2026-87678 | < 10.0.1 | An input validation and output encoding vulnerability exists in the web management interface of Brocade Fabric OS versions before 10.0.1. Wh | MEDIUM 6.9 | 0.2 % | ||
| CVE-2026-87676 | < 10.0.1 | A stack-based buffer overflow vulnerability exists in the security library component of Brocade Fabric OS versions before 10.0.1. When parsi | MEDIUM 6.9 | 0.1 % | ||
| CVE-2026-87686 | < 10.0.1 | An authentication and access control bypass vulnerability exists in the web server management interface of Brocade Fabric OS versions before | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-94578 | < 10.0.1 | Brocade Fabric OS versions before 10.0.1 contain an authorization logic vulnerability in the AAA (Authentication, Authorization, and Account | HIGH 7.5 | 0.4 % | ||
| CVE-2026-87659 | < 10.0.1 | A critical authorization bypass vulnerability exists in the Management Server handling of Brocade Fabric OS versions before 10.0.1. A compro | HIGH 7.1 | 0.2 % | ||
| CVE-2026-87671 | < 10.0.1 | An out-of-bounds memory read vulnerability exists in the web management daemon of Brocade Fabric OS versions before 10.0.1. Unauthenticated | HIGH 7.1 | 0.4 % | ||
| CVE-2026-87684 | < 10.0.1 | A stack-based buffer overflow vulnerability exists in the SNMP daemon request handling of Brocade Fabric versions before 10.0.1. When proces | HIGH 8.7 | 0.6 % | ||
| CVE-2026-87683 | < 10.0.1 | Multiple stack-based buffer overflow vulnerabilities exist in the REST API management component of Brocade Fabric OS versions prior to 10.0. | HIGH 8.6 | 0.5 % | ||
| CVE-2026-87682 | < 10.0.1 | Multiple OS Command Injection vulnerabilities exist in the management interface and session processing routines of Brocade Fabric OS version | HIGH 8.6 | 1.7 % | ||
| CVE-2026-87681 | < 10.0.1 | An Access Control Bypass vulnerability exists in the Role-Based Access Control (RBAC) validation engine of Brocade Fabric OS versions before | HIGH 7.1 | 0.2 % | ||
| CVE-2026-87680 | < 10.0.1 | A command injection vulnerability in the REST API management interface of Brocade Fabric OS versions before 10.0.1 allows an authenticated u | HIGH 8.5 | 1.9 % | ||
| CVE-2026-87679 | < 10.0.1 | When Brocade Fabric OS versions before 10.0.1 processes trunk configuration operations, the application parses user-supplied list strings in | HIGH 8.5 | 0.4 % | ||
| CVE-2025-58381 | before 9.2.1c2 | Directory transversal vulnerability in Brocade Fabric OS before 9.2.1c2 and 9.2.2 through 9.2.2a using various shell commands | MEDIUM 4.6 | 0.2 % | ||
| CVE-2025-9711 | before 9.2.1c3, and 9.2.2 though 9.2.2b | Privilege escalation in Brocade Fabric OS before 9.2.1c3, and 9.2.2 though 9.2.2b | HIGH 8.5 | 0.1 % | ||
| CVE-2025-58380 | before 9.2.1 | Directory transversal vulnerability in Brocade Fabric OS before 9.2.1 using grep command | MEDIUM 4.6 | 0.2 % | ||
| CVE-2026-0383 | before 9.2.1c2, 9.2.2 through 9.2.2a and 10.0.0 | Information disclosure in Brocade Fabric OS before 9.2.1c2, 9.2.2 through 9.2.2a and 10.0.0 | HIGH 8.2 | 0.2 % | ||
| CVE-2025-58379 | before 9.2.1 | Password Exposure in Brocade Fabric OS | MEDIUM 6.0 | 0.2 % | ||
| CVE-2025-58383 | before 9.2.1c2 | Privilege escalation via bind command in Brocade Fabric OS | HIGH 8.4 | 0.5 % | ||
| CVE-2025-58382 | before 9.2.1c2 and 9.2.2 through 9.2.2a | Privilege escalation in Brocade Fabric before 9.2.1c2 and 9.2.2 through 9.2.2a | HIGH 8.5 | 0.6 % | ||
| CVE-2025-4661 | Brocade Fabric OS 9.1.0 through 9.2.2 | Path transversal vulnerability potentially leading to sensitive information disclosure | MEDIUM 4.8 | 0.2 % | ||
| CVE-2025-1976 | Fabric OS versions 9.1.0 through 9.1.1d6 | Code injection exposure in Fabric OS 9.1.0 through 9.1.1d6 | HIGH 8.6 | 0.7 % | KEV | |
| CVE-2024-7517 | Brocade Fabric OS versions before 9.2.0c, and 9.2.1 through 9.2.1a | Privileged escalation via crafted use of portcfg command | HIGH 8.5 | 0.6 % | ||
| CVE-2024-10403 | Brocade Fabric OS versions before 8.2.3e2, versions 9.0.0 through 9.2.0c, and 9.2.1 through 9.2.1a | SFTP/FTP password could be captured in plain text in Supportsave generated from SANnav | MEDIUM 5.9 | 0.7 % | ||
| CVE-2024-7516 | before 9.2.2 | Brocade Fabric OS before 9.2.2 does not enforce strict host key checking | HIGH 7.0 | 0.3 % | ||
| CVE-2024-5460 | prior to v9.0.0 | Brocade Fabric OS versions prior to v9.0 have default community strings | HIGH 8.1 | 0.5 % | ||
| CVE-2024-29954 | before v9.2.1, v9.2.0b, v9.1.1d, and v8.2.3e | password management API prints sensitive information in log files | MEDIUM 5.9 | 0.1 % | ||
| CVE-2024-29953 | before v9.2.1, v9.2.0b, and v9.1.1d | Encoded session passwords on session storage for Virtual Fabric platforms | MEDIUM 4.3 | 0.3 % | ||
| CVE-2023-5973 | Versions v9.x and before v9.2.0 | Truncated port name | MEDIUM 4.3 | 0.2 % | ||
| CVE-2023-3454 | after v9.0 and before v9.2.0 | Remote code execution (RCE) vulnerability in Brocade Fabric OS after v9.0 and before v9.2.0 could allow an attacker to execute arbitrary cod | CRITICAL 9.8 | 1.2 % | ||
| CVE-2023-4162 | Brocade Fabric OS after Brocade Fabric OS v9.0 and before Brocade Fabric OS v9.2.0a | Segmentation fault in Brocade Fabric OS after Brocade Fabric OS v9.0 | MEDIUM 4.4 | 0.2 % | ||
| CVE-2023-3489 | Brocade Fabric OS v9.2.0 | firmwaredownload command could log servers passwords in clear text | HIGH 8.6 | 0.4 % | ||
| CVE-2023-31926 | before Brocade Fabric OS v9.1.1c and v9.2.0 | Arbitrary File Overwrite using less command | HIGH 7.1 | 0.2 % | ||
| CVE-2023-31927 | before Brocade Fabric OS v9.2.0 and v9.1.1c | An information disclosure in the web interface of Brocade Fabric OS | MEDIUM 5.3 | 0.6 % | ||
| CVE-2023-31432 | before Brocade Fabric OS v9.1.1c and v9.2.0 | Privilege issues in multiple commands | HIGH 7.8 | 0.2 % | ||
| CVE-2023-31928 | before Brocade Fabric OS v9.2.0 | XSS vulnerability in Brocade Webtools | MEDIUM 6.3 | 0.5 % | ||
| CVE-2023-31428 | before Brocade Fabric OS v9.1.1c, v9.2.0 | CLI allows upload or transfer files of dangerous types | MEDIUM 5.5 | 0.2 % | ||
| CVE-2023-31431 | before Brocade Fabric OS v9.1.1c, v9.2.0 | A buffer overflow vulnerability in “diagstatus” command | MEDIUM 5.5 | 0.3 % | ||
| CVE-2023-31427 | after 9.1.0 and before Brocade Fabric OS v9.2.0 and v9.1.1c | Knowledge of full path name | HIGH 7.8 | 0.2 % | ||
| CVE-2023-31425 | after Brocade Fabric OS v9.1.0 and, before Brocade Fabric OS v9.1.1 | Privilege escalation via the fosexec command | HIGH 7.8 | 0.3 % | ||
| CVE-2023-31429 | before Brocade Fabric OS v9.1.1c, v9.2.0 | Multiple commands print sensitive information in the terminal | MEDIUM 5.5 | 0.2 % |