CVE-2026-87683: Buffer Overflow
Multiple stack-based buffer overflow vulnerabilities exist in the REST API management component of Brocade Fabric OS versions prior to 10.0.1. When processing API request payloads (such as device configuration attributes or port mapping requests) the REST API service fails to properly validate incoming array counts and string lengths against internal buffer capacities. An authenticated attacker with REST API access can transmit crafted, oversized request parameters to induce memory corruption on the execution stack. This may result in a denial-of-service condition (daemon crash) or potential arbitrary code execution within the management process context.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Brocade Fabric OSto a version that resolves this vulnerability.Fixed in 10.0.1
Event History
Frequently Asked Questions
Which Fabric OS versions need remediation?
Brocade Fabric OS versions earlier than 10.0.1 are affected. Systems running 10.0.1 or later are not identified as affected by the provided advisory data.
What access does an attacker need to exploit this issue?
An attacker must be authenticated and have access to the REST API. Exploitation does not require user interaction.
How can I assess whether a device is exposed?
Identify the Fabric OS version in use and determine whether the REST API is accessible to authenticated users. Devices running a version earlier than 10.0.1 with REST API access should be treated as exposed.