https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-94587.htmlhttps://patchthecve.com/cve/CVE-2026-94587.htmlWed, 14 Oct 2026 19:36:23 +0000MEDIUM 4.5: A buffer overflow vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operations of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user with permissions to perform configuration downloads using remote https://patchthecve.com/cve/CVE-2026-94586.htmlhttps://patchthecve.com/cve/CVE-2026-94586.htmlWed, 14 Oct 2026 19:36:00 +0000MEDIUM 6.8: A command injection vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operations of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user with permissions to perform configuration downloads using remothttps://patchthecve.com/cve/CVE-2026-94585.htmlhttps://patchthecve.com/cve/CVE-2026-94585.htmlWed, 14 Oct 2026 19:35:47 +0000HIGH 8.8: An authentication bypass vulnerability exists in the web management interface of Brocade Fabric OS versions before 9.2.2d running on the MXG610 platform. An unauthenticated, network-adjacent attacker can exploit an unauthenticated endpoint within the Single Sign-On (SSO) workflow to gain administrathttps://patchthecve.com/cve/CVE-2026-94581.htmlhttps://patchthecve.com/cve/CVE-2026-94581.htmlWed, 14 Oct 2026 19:35:26 +0000MEDIUM 6.8: An OS command injection vulnerability exists in the REST API management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 allows an authenticated, high-privileged remote attacker to execute arbitrary system commands with root permissions. An attacker with administratihttps://patchthecve.com/cve/CVE-2026-94579.htmlhttps://patchthecve.com/cve/CVE-2026-94579.htmlWed, 14 Oct 2026 19:35:06 +0000HIGH 8.0: An OS command injection vulnerability exists in the PAM (Pluggable Authentication Module) session cleanup routines during SSH session termination on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user authenticating via an external directory or AAA service whohttps://patchthecve.com/cve/CVE-2026-94577.htmlhttps://patchthecve.com/cve/CVE-2026-94577.htmlWed, 14 Oct 2026 19:34:37 +0000HIGH 7.8: A privilege escalation vulnerability exists in the internal Command-Line Interface (CLI) authorization handling mechanism of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user or local process that can manipulate the process execution environment can bypass Rhttps://patchthecve.com/cve/CVE-2026-94576.htmlhttps://patchthecve.com/cve/CVE-2026-94576.htmlWed, 14 Oct 2026 19:34:13 +0000HIGH 8.0: An authentication logic and privilege escalation vulnerability exists in the account management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. Under specific conditions, an authenticated user can bypass authorization restrictions intended to prevent modifying anothttps://patchthecve.com/cve/CVE-2026-87677.htmlhttps://patchthecve.com/cve/CVE-2026-87677.htmlWed, 14 Oct 2026 19:33:34 +0000MEDIUM 6.6: An OS command injection vulnerability exists in the account management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When an administrator initiates an account deletion, the system invokes an internal maintenance routine to clean up cryptographic keys associated https://patchthecve.com/cve/CVE-2026-87664.htmlhttps://patchthecve.com/cve/CVE-2026-87664.htmlWed, 14 Oct 2026 19:33:18 +0000HIGH 7.8: A session context forgery vulnerability exists in the web management daemon of Brocade Fabric OS versions 9.2.2d and 10.0.0 through 10.0.0a1. When processing local inter-process communication (IPC) storage callbacks, the service accepts and registers session structures including administrative role https://patchthecve.com/cve/CVE-2026-87663.htmlhttps://patchthecve.com/cve/CVE-2026-87663.htmlWed, 14 Oct 2026 19:33:03 +0000MEDIUM 6.7: An authentication bypass and command injection vulnerability exists in the inter-switch remote execution service of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When processing remote command execution IPC frames across the fabric, the receiving switch processes these commanhttps://patchthecve.com/cve/CVE-2026-87662.htmlhttps://patchthecve.com/cve/CVE-2026-87662.htmlWed, 14 Oct 2026 19:32:30 +0000MEDIUM 6.7: Brocade Fabric versions before 9.2.2d and 10.0.0 through 10.0.0a1 handling of specific download protocols utilizes unsanitized parameter strings. When processing upgrade requests, parameters are converted into system command strings and executed through a system shell interface. Because control charhttps://patchthecve.com/cve/CVE-2026-87661.htmlhttps://patchthecve.com/cve/CVE-2026-87661.htmlWed, 14 Oct 2026 19:31:17 +0000MEDIUM 5.7: Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 directly accepts Apache configuration file data during service setup or re-initialization. An attacker capable of corrupting the configuration structure will prevent the web management service from starting or recovering during serhttps://patchthecve.com/cve/CVE-2026-94584.htmlhttps://patchthecve.com/cve/CVE-2026-94584.htmlWed, 14 Oct 2026 19:15:55 +0000LOW 2.6: A race condition and thread-safety vulnerability exists in the web management daemon of Brocade Fabric OS versions before 10.0.1. When handling user authentication requests across a multi-threaded execution pool, this race condition causes PAM modules to process stale or incorrect client IP addressehttps://patchthecve.com/cve/CVE-2026-94580.htmlhttps://patchthecve.com/cve/CVE-2026-94580.htmlWed, 14 Oct 2026 19:16:30 +0000MEDIUM 4.5: An arbitrary file and directory deletion vulnerability exists in the REST API management interface handling USB storage operations on Brocade Fabric OS versions before 10.0.1. An authenticated user possessing USB management privileges can manipulate requested target paths to delete arbitrary files ohttps://patchthecve.com/cve/CVE-2026-94575.htmlhttps://patchthecve.com/cve/CVE-2026-94575.htmlWed, 14 Oct 2026 14:18:17 +0000MEDIUM 5.7: A logic vulnerability in Brocade Fabric OS versions before 10.0.1 web management framework allows an authenticated, low-privileged user to bypass inner Role-Based Access Control (RBAC) checks under specific environmental conditions. Successful exploitation lowers the system authorization mode for thhttps://patchthecve.com/cve/CVE-2026-87688.htmlhttps://patchthecve.com/cve/CVE-2026-87688.htmlWed, 14 Oct 2026 19:16:58 +0000MEDIUM 6.8: An input validation vulnerability exists in the security certificate management component of the Brocade Fabric OS administrative management API. When processing certificate management operations, user-supplied certificate identifiers are handled without adequate sanitization prior to execution in ehttps://patchthecve.com/cve/CVE-2026-87687.htmlhttps://patchthecve.com/cve/CVE-2026-87687.htmlWed, 14 Oct 2026 19:10:43 +0000HIGH 7.3: An authorization and input validation vulnerability exists in Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user with restricted privileges in one Virtual Fabric can exploit this issue by submitting a specially crafted request containing an arbitrary fabric ihttps://patchthecve.com/cve/CVE-2026-87685.htmlhttps://patchthecve.com/cve/CVE-2026-87685.htmlWed, 14 Oct 2026 19:11:25 +0000MEDIUM 6.8: An arbitrary file manipulation vulnerability exists in the WebTools management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When processing configuration transfer requests, the application fails to properly validate and sanitize a user-supplied status file path https://patchthecve.com/cve/CVE-2026-87675.htmlhttps://patchthecve.com/cve/CVE-2026-87675.htmlWed, 14 Oct 2026 19:09:49 +0000MEDIUM 6.8: An OS command injection vulnerability exists in the configuration management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When performing a configuration download operation, the management daemon will relay configuration parameters, user-supplied relay host strihttps://patchthecve.com/cve/CVE-2026-87674.htmlhttps://patchthecve.com/cve/CVE-2026-87674.htmlWed, 14 Oct 2026 19:11:51 +0000HIGH 7.8: A local privilege escalation vulnerability exists in the system logging daemon of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. Insufficient access controls on internal inter-process communication (IPC) channels allow an unprivileged local user to submit malformed logging conhttps://patchthecve.com/cve/CVE-2026-87673.htmlhttps://patchthecve.com/cve/CVE-2026-87673.htmlWed, 14 Oct 2026 19:12:50 +0000HIGH 7.2: An OS command injection vulnerability exists in maintenance command-line diagnostic utilities on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. The binary fails to sanitize user-supplied input options when invoking underlying system commands through a shell interpreter. A privhttps://patchthecve.com/cve/CVE-2026-87667.htmlhttps://patchthecve.com/cve/CVE-2026-87667.htmlWed, 14 Oct 2026 19:14:29 +0000MEDIUM 4.5: An argument injection vulnerability exists in the configuration management command-line utility of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When executing configuration viewing commands with search pattern filters, the utility fails to sanitize user-supplied search strinhttps://patchthecve.com/cve/CVE-2026-87666.htmlhttps://patchthecve.com/cve/CVE-2026-87666.htmlWed, 14 Oct 2026 19:14:40 +0000HIGH 8.0: An OS command injection vulnerability exists in the time and zone management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When updating system timezone settings via the REST API or configuration download routines, the system fails to sanitize input values beforehttps://patchthecve.com/cve/CVE-2026-87660.htmlhttps://patchthecve.com/cve/CVE-2026-87660.htmlWed, 14 Oct 2026 19:15:01 +0000HIGH 7.1: An improper file permission and missing authorization vulnerability exists in the diagnostic kernel module subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An unprivileged local user can invoke privileged hardware tests, force system error conditions, reset hardwarehttps://patchthecve.com/cve/CVE-2026-94583.htmlhttps://patchthecve.com/cve/CVE-2026-94583.htmlWed, 14 Oct 2026 14:07:38 +0000LOW 2.6: A race condition vulnerability exists in the request processing logic of the REST management interface on Brocade Fabric OS versions before 10.0.1. When handling concurrent incoming network management FCIP requests, a timing window exists between when a request populates the address variable and whehttps://patchthecve.com/cve/CVE-2026-94582.htmlhttps://patchthecve.com/cve/CVE-2026-94582.htmlWed, 14 Oct 2026 14:09:01 +0000HIGH 7.8: A memory buffer overflow vulnerability exists in the internal diagnostic and route validation routines used by the Fabric Shortest Path First (FSPF) protocol component of Brocade Fabric OS versions before 10.0.1. While this code path is part of internal diagnostic functionality and is not directly ahttps://patchthecve.com/cve/CVE-2026-94578.htmlhttps://patchthecve.com/cve/CVE-2026-94578.htmlWed, 14 Oct 2026 14:26:12 +0000HIGH 8.8: Brocade Fabric OS versions before 10.0.1 contain an authorization logic vulnerability in the AAA (Authentication, Authorization, and Accounting) integration framework allows remote authenticated users to gain root-equivalent chassis access controls. By returning specific, crafted Vendor-Specific Atthttps://patchthecve.com/cve/CVE-2026-87686.htmlhttps://patchthecve.com/cve/CVE-2026-87686.htmlWed, 14 Oct 2026 14:32:30 +0000MEDIUM 4.3: An authentication and access control bypass vulnerability exists in the web server management interface of Brocade Fabric OS versions before 10.0.1. The web dispatcher routine evaluates internal management VLAN trust decisions using the client-supplied HTTP host header instead of the actual socket thttps://patchthecve.com/cve/CVE-2026-87684.htmlhttps://patchthecve.com/cve/CVE-2026-87684.htmlWed, 14 Oct 2026 14:46:52 +0000CRITICAL 9.8: A stack-based buffer overflow vulnerability exists in the SNMP daemon request handling of Brocade Fabric versions before 10.0.1. When processing an incoming SNMPv3 packet, an internal statistics gathering handler copies user-supplied context name data into a fixed-size buffer without properly validahttps://patchthecve.com/cve/CVE-2026-87678.htmlhttps://patchthecve.com/cve/CVE-2026-87678.htmlWed, 14 Oct 2026 14:47:25 +0000MEDIUM 5.2: An input validation and output encoding vulnerability exists in the web management interface of Brocade Fabric OS versions before 10.0.1. When configuring Federated Authentication (FA), the system fails to sanitize the Identity Provider (IdP) issuer parameter. An authenticated administrator—or an athttps://patchthecve.com/cve/CVE-2026-87676.htmlhttps://patchthecve.com/cve/CVE-2026-87676.htmlWed, 14 Oct 2026 14:47:55 +0000MEDIUM 5.7: A stack-based buffer overflow vulnerability exists in the security library component of Brocade Fabric OS versions before 10.0.1. When parsing uploaded X.509 PEM certificates for management display, the system improperly validates the length of the Authority Key Identifier (AKI) extension before cophttps://patchthecve.com/cve/CVE-2026-87672.htmlhttps://patchthecve.com/cve/CVE-2026-87672.htmlWed, 14 Oct 2026 14:05:59 +0000MEDIUM 5.5: An information disclosure vulnerability exists in the SupportLink diagnostic collection utilities of Brocade Fabric OS versions before 10.0.1. When SupportLink is configured to use an authenticated HTTP proxy, the system stores the full proxy URL. Anyone with access to the diagnostic support bundle,https://patchthecve.com/cve/CVE-2026-87671.htmlhttps://patchthecve.com/cve/CVE-2026-87671.htmlTue, 13 Oct 2026 17:15:46 +0000HIGH 7.5: An out-of-bounds memory read vulnerability exists in the web management daemon of Brocade Fabric OS versions before 10.0.1. Unauthenticated HTTP endpoints process specific URL query parameters without validating array index boundaries or performing numerical range checks. An unauthenticated remote ahttps://patchthecve.com/cve/CVE-2026-87670.htmlhttps://patchthecve.com/cve/CVE-2026-87670.htmlTue, 13 Oct 2026 17:16:45 +0000MEDIUM 4.3: An authorization logic vulnerability exists in the Brocade Fabric OS versions before 10.0.1 REST API gateway. The internal gate guarding restricted management endpoints relies exclusively on client-controlled HTTP headers. An authenticated user with any valid REST session can spoof these headers to https://patchthecve.com/cve/CVE-2026-87669.htmlhttps://patchthecve.com/cve/CVE-2026-87669.htmlTue, 13 Oct 2026 17:17:43 +0000MEDIUM 4.3: A missing authorization check in Brocade Fabric OS versions before 10.0.1 REST API interface of affected platform releases allows an authenticated user, regardless of their assigned role or administrative scope, to retrieve complete Monitoring and Alerting Policy Suite (MAPS) violation data across ahttps://patchthecve.com/cve/CVE-2026-87668.htmlhttps://patchthecve.com/cve/CVE-2026-87668.htmlTue, 13 Oct 2026 17:23:22 +0000MEDIUM 6.5: A stack-based buffer overflow vulnerability exists in the diagnostic execution utility of Brocade Fabric OS versions before 10.0.1. When processing command arguments for diagnostic operations, the utility tokenizes user-supplied input into an internal argument array without enforcing boundary checkshttps://patchthecve.com/cve/CVE-2026-87665.htmlhttps://patchthecve.com/cve/CVE-2026-87665.htmlTue, 13 Oct 2026 17:24:29 +0000HIGH 7.5: A stack-based buffer overflow vulnerability exists in the Internet Key Exchange (IKEv2) protocol handler on Brocade Fabric OS versions before 10.0.1. The vulnerability occurs when processing initial IKE key exchange requests on extension switches or blades running IPsec-enabled Fibre Channel over IPhttps://patchthecve.com/cve/CVE-2026-87659.htmlhttps://patchthecve.com/cve/CVE-2026-87659.htmlTue, 13 Oct 2026 17:25:28 +0000CRITICAL 9.8: A critical authorization bypass vulnerability exists in the Management Server handling of Brocade Fabric OS versions before 10.0.1. A compromised switch connected to the fabric can transmit crafted inband Fibre Channel vendor-unique CT (Common Transport) management requests to bypass administrative https://patchthecve.com/cve/CVE-2026-87683.htmlhttps://patchthecve.com/cve/CVE-2026-87683.htmlTue, 13 Oct 2026 17:27:15 +0000HIGH 8.8: Multiple stack-based buffer overflow vulnerabilities exist in the REST API management component of Brocade Fabric OS versions prior to 10.0.1. When processing API request payloads (such as device configuration attributes or port mapping requests) the REST API service fails to properly validate incomhttps://patchthecve.com/cve/CVE-2026-87682.htmlhttps://patchthecve.com/cve/CVE-2026-87682.htmlTue, 13 Oct 2026 17:27:59 +0000HIGH 8.8: Multiple OS Command Injection vulnerabilities exist in the management interface and session processing routines of Brocade Fabric OS versions before 10.0.1. Input processing flaws during remote management connection validation and session verification for directory-based user accounts allow untrustehttps://patchthecve.com/cve/CVE-2026-87681.htmlhttps://patchthecve.com/cve/CVE-2026-87681.htmlTue, 13 Oct 2026 14:13:31 +0000MEDIUM 6.3: An Access Control Bypass vulnerability exists in the Role-Based Access Control (RBAC) validation engine of Brocade Fabric OS versions before 10.0.1. When processing certain management protocol operations, the RBAC engine incorrectly categorizes non-standard action opcodes during permission checks. Thttps://patchthecve.com/cve/CVE-2026-87680.htmlhttps://patchthecve.com/cve/CVE-2026-87680.htmlTue, 13 Oct 2026 14:17:05 +0000HIGH 8.8: A command injection vulnerability in the REST API management interface of Brocade Fabric OS versions before 10.0.1 allows an authenticated user to execute arbitrary system commands via crafted input parameters.https://patchthecve.com/cve/CVE-2026-87679.htmlhttps://patchthecve.com/cve/CVE-2026-87679.htmlTue, 13 Oct 2026 14:17:12 +0000HIGH 7.2: When Brocade Fabric OS versions before 10.0.1 processes trunk configuration operations, the application parses user-supplied list strings into dynamically allocated heap arrays without enforcing boundary checks on the maximum allowable number of elements. An authenticated administrator can exploit t