CVE-2026-87671
Received Received - Intake

Memory Corruption in Brocade Fabric OS Web Management

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: Brocade Communications Systems, LLC

Description
An out-of-bounds memory read vulnerability exists in the web management daemon of Brocade Fabric OS versions before 10.0.1. Unauthenticated HTTP endpoints process specific URL query parameters without validating array index boundaries or performing numerical range checks. An unauthenticated remote attacker can exploit this issue by sending a single, crafted HTTP request containing extreme numerical values in the query string. This causes an invalid memory dereference, resulting in a crash of the web management process (Denial of Service) and potential temporary management-plane disruption.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-08
Last Modified
2026-10-08
Generated
2026-10-08
AI Q&A
2026-10-08
EPSS Evaluated
N/A
NVD
CVE-2026-87671
EUVD
EUVD-2026-94667

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Brocade Fabric OS 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an out-of-bounds memory read vulnerability in Brocade Fabric OS versions before 10.0.1. It affects unauthenticated HTTP endpoints that process URL query parameters without validating array index boundaries or numerical ranges. An attacker can exploit it by sending a crafted HTTP request with extreme numerical values, causing a memory dereference error that crashes the web management process and disrupts management-plane operations.

Detection Guidance

Detecting this vulnerability requires monitoring for crashes in the Brocade Fabric OS web management daemon or unusual HTTP requests with extreme numerical values in query parameters. Check logs for HTTP 500 errors or process crashes in the web management service. Use network monitoring tools to inspect HTTP traffic for malformed query strings containing very large numbers.

Impact Analysis

The vulnerability allows an unauthenticated remote attacker to crash the web management process, leading to temporary loss of management-plane functionality. This could disrupt network operations, prevent administrative access, and cause downtime for systems relying on Brocade Fabric OS versions before 10.0.1.

Compliance Impact

This vulnerability causes temporary management-plane disruption due to a Denial of Service condition, which may lead to unauthorized access or loss of availability of critical systems. Such disruptions could impact compliance with GDPR's availability requirements or HIPAA's access controls, depending on the system's role in processing sensitive data.

Mitigation Strategies

Immediately upgrade Brocade Fabric OS to version 10.0.1 or later to patch the vulnerability. If upgrading is not immediately possible, restrict access to the web management interface by blocking external HTTP traffic to the management plane or disabling the web management daemon if not required. Monitor for exploitation attempts and ensure backups of critical configurations are available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-87671. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart