Broadcom Fabric OS: Stack-based buffer overflow in REST API
Summary
Multiple stack-based buffer overflows in the REST API management component of Brocade Fabric OS before 10.0.1 allow an attacker to corrupt memory by sending oversized array counts or strings in API requests. The impact can be a crash of the management daemon (denial of service) or potentially arbitrary code execution in the management process. An attacker needs network access to the REST API and valid low-privileged credentials with REST API rights.
Affected
- Brocade Fabric OS versions prior to 10.0.1 (CNA range: before 10.0.1)
- Fibre Channel SAN switches running Fabric OS, including HPE rebranded models
- Unknown: whether the 9.2.x branch is affected and which fixed build applies there
Fixed in
- Fabric OS 10.0.1 (per Broadcom bulletin 25000)
- Unknown: fixed build for 9.2.x, to be verified in Broadcom advisory 39077
Workaround
Unknown. No vendor workaround was found in the available sources.
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact total
- Not listed in CISA KEV
- VulDB: technical details unknown, no public exploit available
- EPSS low (0.00481)
Our recommendation
- Patch Fabric OS to 10.0.1 in the next maintenance window, together with related REST API fix CVE-2026-87680
- Verify the fixed build for 9.2.x in Broadcom advisory 39077 before rollout
- Restrict REST API access to a dedicated management network
- Limit and audit accounts that hold REST API rights
- Monitor switch management logs for unusual API requests and daemon crashes
- If you run no Fibre Channel SAN switches, no action is needed
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Broadcom advisory 39077 support.broadcom.com
- Broadcom bulletin 25000 support.broadcom.com
- VulDB CVE-2026-87683 vuldb.com
- Vulners/Rapid7 CVE-2026-87683 vulners.com
- OpenCVE CVE-2026-87683 app.opencve.io
- Threatint CVE-2026-87683 cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 09:12.
Original description (NVD)
Multiple stack-based buffer overflow vulnerabilities exist in the REST API management component of Brocade Fabric OS versions prior to 10.0.1. When processing API request payloads (such as device configuration attributes or port mapping requests) the REST API service fails to properly validate incoming array counts and string lengths against internal buffer capacities. An authenticated attacker with REST API access can transmit crafted, oversized request parameters to induce memory corruption on the execution stack. This may result in a denial-of-service condition (daemon crash) or potential arbitrary code execution within the management process context.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.