---
id: CVE-2026-94587
title: >-
  A buffer overflow vulnerability exists in the WebTools administrative
  interface handling configuration download or file transfer operations of
  Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1
summary: >-
  A buffer overflow vulnerability exists in the WebTools administrative
  interface handling configuration download or file transfer operations of
  Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An
  authenticated user wi…
severity: medium
cvss: 4.5
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-120
vendor: broadcom
product: fabric_operating_system
affected:
  - fabric_operating_system < 9.2.2d
  - 'fabric_operating_system >= 10.0.0, < 10.0.1'
patched:
  - fabric_operating_system 10.0.1
published: '2026-10-08'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T19:36:23.850'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-94587'
references:
  - url: 'https://support.broadcom.com/external/content/SecurityAdvisories/0/39136'
    label: sirt@brocade.com
tags:
  - nvd
  - cve.org
  - score-dispute
epss: 0.00186
epssPercentile: 0.08073
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-08T15:14:45.538758Z'
scores:
  nvd: 4.5
  cna: 6.9
ingestedAt: '2026-10-08T05:05:36.678Z'
---

## Overview

A buffer overflow vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operations of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user with permissions to perform configuration downloads using remote server profiles can overflow stack buffers causing a crash of the weblinker daemon.

## Affected

- `fabric_operating_system < 9.2.2d`
- `fabric_operating_system >= 10.0.0, < 10.0.1`

## Remediation

Upgrade past the affected range:

- `fabric_operating_system 10.0.1`