---
id: CVE-2026-87671
title: >-
  An out-of-bounds memory read vulnerability exists in the web management daemon
  of Brocade Fabric OS versions before 10.0.1
summary: >-
  An out-of-bounds memory read vulnerability exists in the web management daemon
  of Brocade Fabric OS versions before 10.0.1. Unauthenticated HTTP endpoints
  process specific URL query parameters without validating array index
  boundaries or…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-125
vendor: broadcom
product: fabric_operating_system
affected:
  - fabric_operating_system < 10.0.1
patched:
  - fabric_operating_system 10.0.1
published: '2026-10-08'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T17:15:46.667'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-87671'
references:
  - url: 'https://support.broadcom.com/external/content/SecurityAdvisories/0/39141'
    label: sirt@brocade.com
tags:
  - nvd
  - cve.org
epss: 0.00398
epssPercentile: 0.33807
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-08T14:57:22.906701Z'
scores:
  nvd: 7.5
  cna: 7.1
ingestedAt: '2026-10-08T03:03:35.549Z'
---

## Overview

An out-of-bounds memory read vulnerability exists in the web management daemon of Brocade Fabric OS versions before 10.0.1. Unauthenticated HTTP endpoints process specific URL query parameters without validating array index boundaries or performing numerical range checks. An unauthenticated remote attacker can exploit this issue by sending a single, crafted HTTP request containing extreme numerical values in the query string. This causes an invalid memory dereference, resulting in a crash of the web management process (Denial of Service) and potential temporary management-plane disruption.

## Affected

- `fabric_operating_system < 10.0.1`

## Remediation

Upgrade past the affected range:

- `fabric_operating_system 10.0.1`