https://vulnogram.org/ Most recent CVEs assigned by Brocade Communications Systems LLC, a Broadcom Company (brocade). https://vulnogram.org/seaview/icons/brocade.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-87428 https://vulnogram.org/CVE-2026-87428 In Brocade ASCG before 3.5.0, a local unauthorized user on the ASCG VM who can issue a request to the SANnav host network namespace can extract stored management credentials for onboarded SANnav instances and compromise connected Brocade SANnav serve… High Thu, 08 Oct 2026 07:00:52 GMT https://vulnogram.org/CVE-2026-87426 https://vulnogram.org/CVE-2026-87426 An unauthenticated network-based attacker can query specific internal management endpoints on Brocade ASCG versions before 3.5.0 to enumerate the configuration details and state of managed Brocade Fabric OS (FOS) switches. This results in the unautho… Medium Thu, 08 Oct 2026 06:54:22 GMT https://vulnogram.org/CVE-2026-87425 https://vulnogram.org/CVE-2026-87425 An unauthenticated remote attacker can modify the TLS client trust store in Brocade ASCG versions before 3.5.0. By supplying an unauthorized Certificate Authority (CA) certificate to an unauthenticated management interface, the attacker can cause the… High Thu, 08 Oct 2026 06:51:26 GMT https://vulnogram.org/CVE-2026-87424 https://vulnogram.org/CVE-2026-87424 A vulnerability in the SupportLink API authentication component of Brocade ASCG versions prior to 3.5.0 allows an attacker to bypass authentication across deployments due to the use of a hard coded cryptographic key. High Thu, 08 Oct 2026 06:48:02 GMT https://vulnogram.org/CVE-2026-85490 https://vulnogram.org/CVE-2026-85490 When Brocade ASCG before 3.5.0 processes support bundle archives ingested from remote compromised endpoints, the application fails to sanitize path traversal sequences contained within archive entries prior to extraction. An unauthenticated remote at… High Thu, 08 Oct 2026 06:42:43 GMT https://vulnogram.org/CVE-2026-85489 https://vulnogram.org/CVE-2026-85489 An authentication flaw exists in the Brocade ASCG administrative management service component. An unauthenticated network user can issue direct API requests to perform privileged actions, including accessing sensitive system configuration mapping dat… High Thu, 08 Oct 2026 06:39:59 GMT https://vulnogram.org/CVE-2026-85488 https://vulnogram.org/CVE-2026-85488 Brocade ASCG before 3.5.0 has a well-known Brocade default password embedded in a script distributed to every customer. Any local authenticated user with read access to the installation path can discover this credential and perform privilege escalati… High Thu, 08 Oct 2026 06:36:17 GMT https://vulnogram.org/CVE-2026-85487 https://vulnogram.org/CVE-2026-85487 A path traversal vulnerability exists in the HTTP service component of Brocade ASCG versions before 3.5.0. An unauthenticated attacker on the local network could send a manipulated API request to the service endpoint bypassing path restrictions to ar… High Thu, 08 Oct 2026 06:32:03 GMT https://vulnogram.org/CVE-2026-85486 https://vulnogram.org/CVE-2026-85486 Brocade ASCG before 3.5.0 improperly processes user input by evaluating form data prior to validation. When an authenticated user submits a configuration form, the submitted text could immediately be processed. A malicious actor with basic access can… High Thu, 08 Oct 2026 06:29:31 GMT https://vulnogram.org/CVE-2026-85423 https://vulnogram.org/CVE-2026-85423 A vulnerability has been identified in the data collection service of Brocade ASCG versions before 3.5.0. An API endpoint within the data collector service fails to perform authentication or authorization checks on incoming requests. An attacker with… High Thu, 08 Oct 2026 06:25:40 GMT https://vulnogram.org/CVE-2026-85422 https://vulnogram.org/CVE-2026-85422 A vulnerability in Brocade ASCG version before 3.5.0 could allow an attacker to obtain a static cryptographic key hardcoded into the software binaries to secure sensitive data at rest and to protect inter-node communication protocols. An attacker who… High Thu, 08 Oct 2026 06:20:40 GMT https://vulnogram.org/CVE-2026-85421 https://vulnogram.org/CVE-2026-85421 A critical security vulnerability has been identified in Brocade ASCG versions before 3.5.0. The HTTPS service fails to properly enforce authentication or access control checks on incoming requests. An unauthenticated attacker with network access can… High Thu, 08 Oct 2026 06:16:11 GMT https://vulnogram.org/CVE-2026-5769 https://vulnogram.org/CVE-2026-5769 A vulnerability in Brocade SANnav before 3.0.1 can have the Brocade Fabric OS switch admin password captured in plaintext within a memory swap file on the server hosting the Brocade SANnav Virtual Machine (VM). This can happen when the SANnav server… Medium Thu, 08 Oct 2026 06:07:03 GMT https://vulnogram.org/CVE-2026-5049 https://vulnogram.org/CVE-2026-5049 A path traversal vulnerability affects the The Zone Alias Import flow feature in Brocade SANnav before 3.0.0a. A local authenticated attacker can write an uploaded content outside the intended directory. Medium Thu, 08 Oct 2026 05:29:14 GMT https://vulnogram.org/CVE-2026-5048 https://vulnogram.org/CVE-2026-5048 In Brocade SANnav before 3.0.0a, an SQL Injection vulnerability in various external API inventories have a vulnerability that allows an authenticated attacker to inject malicious data into some of the REST API -query parameters. Medium Thu, 08 Oct 2026 05:23:56 GMT https://vulnogram.org/CVE-2026-5047 https://vulnogram.org/CVE-2026-5047 A vulnerability in Brocade SANnav before 2.4.0b and 3.0.0 prints encoded passwords and authentication tokens in log files. The vulnerability could allow an authenticated attacker with access to the log file including the SANnav supportsave to access… High Thu, 08 Oct 2026 05:18:55 GMT https://vulnogram.org/CVE-2023-5649 https://vulnogram.org/CVE-2023-5649 An Improper Input Validation vulnerability for the registered case credentials in Brocade ASCG before v3.0 could allow a local authenticated user to provide invalid inputs like special characters leading to a Denial of Service (DoS) when collecting “… Medium Thu, 08 Oct 2026 05:06:06 GMT https://vulnogram.org/CVE-2023-5648 https://vulnogram.org/CVE-2023-5648 In Brocade ASCG before Brocade ASCG v3.0, several security-related HTTP Headers were missing in various Brocade ASCG URL paths, aiding unauthenticated attackers to perform attacks such as Cross-Site Scripting, Clickjacking, Information disclosure, an… Medium Network Exploitable Thu, 08 Oct 2026 04:56:08 GMT https://vulnogram.org/CVE-2026-94585 https://vulnogram.org/CVE-2026-94585 An authentication bypass vulnerability exists in the web management interface of Brocade Fabric OS versions before 9.2.2d running on the MXG610 platform. An unauthenticated, network-adjacent attacker can exploit an unauthenticated endpoint within the… High Thu, 08 Oct 2026 04:40:08 GMT https://vulnogram.org/CVE-2026-94587 https://vulnogram.org/CVE-2026-94587 A buffer overflow vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operations of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user with permission… Medium Thu, 08 Oct 2026 04:37:56 GMT https://vulnogram.org/CVE-2026-94579 https://vulnogram.org/CVE-2026-94579 An OS command injection vulnerability exists in the PAM (Pluggable Authentication Module) session cleanup routines during SSH session termination on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user authentic… Medium Thu, 08 Oct 2026 04:35:58 GMT https://vulnogram.org/CVE-2026-94576 https://vulnogram.org/CVE-2026-94576 An authentication logic and privilege escalation vulnerability exists in the account management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. Under specific conditions, an authenticated user can bypass authorizati… Medium Thu, 08 Oct 2026 04:34:21 GMT https://vulnogram.org/CVE-2026-87661 https://vulnogram.org/CVE-2026-87661 Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 directly accepts Apache configuration file data during service setup or re-initialization. An attacker capable of corrupting the configuration structure will prevent the web managem… Medium Thu, 08 Oct 2026 04:31:38 GMT https://vulnogram.org/CVE-2026-87677 https://vulnogram.org/CVE-2026-87677 An OS command injection vulnerability exists in the account management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When an administrator initiates an account deletion, the system invokes an internal maintenance… Medium Thu, 08 Oct 2026 04:25:22 GMT https://vulnogram.org/CVE-2026-94586 https://vulnogram.org/CVE-2026-94586 A command injection vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operations of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user with permissi… High Thu, 08 Oct 2026 04:22:23 GMT https://vulnogram.org/CVE-2026-94581 https://vulnogram.org/CVE-2026-94581 An OS command injection vulnerability exists in the REST API management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 allows an authenticated, high-privileged remote attacker to execute arbitrary system commands wi… High Thu, 08 Oct 2026 04:20:30 GMT https://vulnogram.org/CVE-2026-94577 https://vulnogram.org/CVE-2026-94577 A privilege escalation vulnerability exists in the internal Command-Line Interface (CLI) authorization handling mechanism of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user or local process that can manipul… High Thu, 08 Oct 2026 04:18:30 GMT https://vulnogram.org/CVE-2026-87664 https://vulnogram.org/CVE-2026-87664 A session context forgery vulnerability exists in the web management daemon of Brocade Fabric OS versions 9.2.2d and 10.0.0 through 10.0.0a1. When processing local inter-process communication (IPC) storage callbacks, the service accepts and registers… High Thu, 08 Oct 2026 04:16:03 GMT https://vulnogram.org/CVE-2026-87663 https://vulnogram.org/CVE-2026-87663 An authentication bypass and command injection vulnerability exists in the inter-switch remote execution service of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When processing remote command execution IPC frames across the f… High Thu, 08 Oct 2026 04:11:57 GMT https://vulnogram.org/CVE-2026-87662 https://vulnogram.org/CVE-2026-87662 Brocade Fabric versions before 9.2.2d and 10.0.0 through 10.0.0a1 handling of specific download protocols utilizes unsanitized parameter strings. When processing upgrade requests, parameters are converted into system command strings and executed thro… High Thu, 08 Oct 2026 04:02:32 GMT https://vulnogram.org/CVE-2026-87660 https://vulnogram.org/CVE-2026-87660 An improper file permission and missing authorization vulnerability exists in the diagnostic kernel module subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An unprivileged local user can invoke privileged hardware te… High Thu, 08 Oct 2026 03:59:21 GMT https://vulnogram.org/CVE-2026-87667 https://vulnogram.org/CVE-2026-87667 An argument injection vulnerability exists in the configuration management command-line utility of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When executing configuration viewing commands with search pattern filters, the ut… High Thu, 08 Oct 2026 03:56:36 GMT https://vulnogram.org/CVE-2026-87666 https://vulnogram.org/CVE-2026-87666 An OS command injection vulnerability exists in the time and zone management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When updating system timezone settings via the REST API or configuration download routines… High Thu, 08 Oct 2026 03:53:13 GMT https://vulnogram.org/CVE-2026-87675 https://vulnogram.org/CVE-2026-87675 An OS command injection vulnerability exists in the configuration management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When performing a configuration download operation, the management daemon will relay confi… High Thu, 08 Oct 2026 03:34:36 GMT https://vulnogram.org/CVE-2026-87674 https://vulnogram.org/CVE-2026-87674 A local privilege escalation vulnerability exists in the system logging daemon of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. Insufficient access controls on internal inter-process communication (IPC) channels allow an unpri… High Thu, 08 Oct 2026 03:31:26 GMT https://vulnogram.org/CVE-2026-87673 https://vulnogram.org/CVE-2026-87673 An OS command injection vulnerability exists in maintenance command-line diagnostic utilities on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. The binary fails to sanitize user-supplied input options when invoking underlying s… High Thu, 08 Oct 2026 03:29:09 GMT https://vulnogram.org/CVE-2026-87687 https://vulnogram.org/CVE-2026-87687 An authorization and input validation vulnerability exists in Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user with restricted privileges in one Virtual Fabric can exploit this issue by submitting a speciall… High Thu, 08 Oct 2026 03:26:46 GMT https://vulnogram.org/CVE-2026-87685 https://vulnogram.org/CVE-2026-87685 An arbitrary file manipulation vulnerability exists in the WebTools management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When processing configuration transfer requests, the application fails to properly valid… High Thu, 08 Oct 2026 03:24:23 GMT https://vulnogram.org/CVE-2026-87688 https://vulnogram.org/CVE-2026-87688 An input validation vulnerability exists in the security certificate management component of the Brocade Fabric OS administrative management API. When processing certificate management operations, user-supplied certificate identifiers are handled wit… High Thu, 08 Oct 2026 03:20:35 GMT https://vulnogram.org/CVE-2026-94584 https://vulnogram.org/CVE-2026-94584 A race condition and thread-safety vulnerability exists in the web management daemon of Brocade Fabric OS versions before 10.0.1. When handling user authentication requests across a multi-threaded execution pool, this race condition causes PAM module… Low Thu, 08 Oct 2026 03:14:46 GMT https://vulnogram.org/CVE-2026-94580 https://vulnogram.org/CVE-2026-94580 An arbitrary file and directory deletion vulnerability exists in the REST API management interface handling USB storage operations on Brocade Fabric OS versions before 10.0.1. An authenticated user possessing USB management privileges can manipulate… Medium Thu, 08 Oct 2026 03:11:54 GMT https://vulnogram.org/CVE-2026-94575 https://vulnogram.org/CVE-2026-94575 A logic vulnerability in Brocade Fabric OS versions before 10.0.1 web management framework allows an authenticated, low-privileged user to bypass inner Role-Based Access Control (RBAC) checks under specific environmental conditions. Successful exploi… Medium Thu, 08 Oct 2026 03:09:26 GMT https://vulnogram.org/CVE-2026-94583 https://vulnogram.org/CVE-2026-94583 A race condition vulnerability exists in the request processing logic of the REST management interface on Brocade Fabric OS versions before 10.0.1. When handling concurrent incoming network management FCIP requests, a timing window exists between whe… Low Thu, 08 Oct 2026 03:05:22 GMT https://vulnogram.org/CVE-2026-94582 https://vulnogram.org/CVE-2026-94582 A memory buffer overflow vulnerability exists in the internal diagnostic and route validation routines used by the Fabric Shortest Path First (FSPF) protocol component of Brocade Fabric OS versions before 10.0.1. While this code path is part of inter… Medium Thu, 08 Oct 2026 03:03:01 GMT https://vulnogram.org/CVE-2026-87668 https://vulnogram.org/CVE-2026-87668 A stack-based buffer overflow vulnerability exists in the diagnostic execution utility of Brocade Fabric OS versions before 10.0.1. When processing command arguments for diagnostic operations, the utility tokenizes user-supplied input into an interna… Medium Thu, 08 Oct 2026 03:00:54 GMT https://vulnogram.org/CVE-2026-87665 https://vulnogram.org/CVE-2026-87665 A stack-based buffer overflow vulnerability exists in the Internet Key Exchange (IKEv2) protocol handler on Brocade Fabric OS versions before 10.0.1. The vulnerability occurs when processing initial IKE key exchange requests on extension switches or… Medium Thu, 08 Oct 2026 02:58:44 GMT https://vulnogram.org/CVE-2026-87672 https://vulnogram.org/CVE-2026-87672 An information disclosure vulnerability exists in the SupportLink diagnostic collection utilities of Brocade Fabric OS versions before 10.0.1. When SupportLink is configured to use an authenticated HTTP proxy, the system stores the full proxy URL. An… Medium Thu, 08 Oct 2026 02:55:58 GMT https://vulnogram.org/CVE-2026-87670 https://vulnogram.org/CVE-2026-87670 An authorization logic vulnerability exists in the Brocade Fabric OS versions before 10.0.1 REST API gateway. The internal gate guarding restricted management endpoints relies exclusively on client-controlled HTTP headers. An authenticated user with… Medium Thu, 08 Oct 2026 02:51:42 GMT https://vulnogram.org/CVE-2026-87669 https://vulnogram.org/CVE-2026-87669 A missing authorization check in Brocade Fabric OS versions before 10.0.1 REST API interface of affected platform releases allows an authenticated user, regardless of their assigned role or administrative scope, to retrieve complete Monitoring and Al… Medium Thu, 08 Oct 2026 02:48:37 GMT https://vulnogram.org/CVE-2026-87678 https://vulnogram.org/CVE-2026-87678 An input validation and output encoding vulnerability exists in the web management interface of Brocade Fabric OS versions before 10.0.1. When configuring Federated Authentication (FA), the system fails to sanitize the Identity Provider (IdP) issuer… Medium Thu, 08 Oct 2026 02:45:13 GMT