Skip to content
OpenAdvisories
High NCSC-2026-0432 34 CVEs

Kwetsbaarheden verholpen in HPE Brocade Fabric OS

Published Oct 16, 2026 · Updated Oct 16, 2026 · nl

Vendor: Broadcom Vendor: HPE Product: Brocade Fabric OS Product: Fabric OS

Summary

HPE heeft meerdere beveiligingsproblemen verholpen in Brocade Fabric OS, specifiek in versies vóór 10.0.1 en in de 9.2.x en 10.0.x release lijnen.

Details

Interpretaties
De kwetsbaarheden omvatten onder andere authenticatieomzeiling, denial of service, informatielekken, privilege-escalatie, buffer overflows, command injection, en arbitrary code execution. Aanvallers kunnen via verschillende aanvalsvectoren, zoals speciaal vervaardigde managementverzoeken, REST API-aanroepen, web management interfaces, en configuratiebestanden, ongeautoriseerde administratieve acties uitvoeren, root-commando's lokaal of op andere fabric-leden uitvoeren, en systeemprocessen laten crashen.

Sommige kwetsbaarheden maken het mogelijk om sessiecontext te vervalsen, HTTP-headers te spoofen, en gevoelige systeem- en monitoringdata in te zien zonder juiste rechten. Daarnaast zijn er race conditions en thread-safety problemen die leiden tot onjuiste toegangscontrole en audit logging. Specifieke componenten zoals de diagnostic kernel module, IKEv2 protocol handler, WebTools interface, en REST API zijn betrokken bij deze kwetsbaarheden.

Sommige problemen vereisen geauthenticeerde toegang, terwijl andere ook door niet-geauthenticeerde, netwerknabije aanvallers kunnen worden misbruikt. De kwetsbaarheden beïnvloeden de integriteit, vertrouwelijkheid en beschikbaarheid van de fabric operating system omgeving en de onderliggende netwerk- en opslaginfrastructuur.

Oplossingen
HPE heeft updates uitgebracht om de kwetsbaarheden in Brocade Fabric OS te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Vulnerabilities 34

  • High 8.6
    CVE-2026-87666

    An OS command injection vulnerability exists in the time and zone management subsystem of Brocade Fabric OS versions be…

    Brocade Fabric OS
  • High 8.5
    CVE-2026-87664

    A session context forgery vulnerability exists in the web management daemon of Brocade Fabric OS versions 9.2.2d and 10…

    Brocade Fabric OS
  • High 8.5
    CVE-2026-87674

    A local privilege escalation vulnerability exists in the system logging daemon of Brocade Fabric OS versions before 9.2…

    Brocade Fabric OS
  • High 8.5
    CVE-2026-87679

    When Brocade Fabric OS versions before 10.0.1 processes trunk configuration operations, the application parses user-sup…

    Brocade Fabric OS
  • High 8.5
    CVE-2026-87688

    An input validation vulnerability exists in the security certificate management component of the Brocade Fabric OS admi…

    Brocade Fabric OS
  • High 8.5
    CVE-2026-94581

    An OS command injection vulnerability exists in the REST API management interface of Brocade Fabric OS versions before …

    Brocade Fabric OS
  • High 8.5
    CVE-2026-94586

    A command injection vulnerability exists in the WebTools administrative interface handling configuration download or fi…

    Brocade Fabric OS
  • High 8.4
    CVE-2026-87667

    An argument injection vulnerability exists in the configuration management command-line utility of Brocade Fabric OS ve…

    Brocade Fabric OS
  • High 7.7
    CVE-2026-94585

    An authentication bypass vulnerability exists in the web management interface of Brocade Fabric OS versions before 9.2.…

    Brocade Fabric OS
  • High 7.5
    CVE-2026-94578

    Brocade Fabric OS versions before 10.0.1 contain an authorization logic vulnerability in the AAA (Authentication, Autho…

    Brocade Fabric OS
  • High 7.3
    CVE-2026-87675

    An OS command injection vulnerability exists in the configuration management subsystem of Brocade Fabric OS versions be…

    Brocade Fabric OS
  • High 7.3
    CVE-2026-94577

    A privilege escalation vulnerability exists in the internal Command-Line Interface (CLI) authorization handling mechani…

    Brocade Fabric OS
  • High 7.1
    CVE-2026-87659

    A critical authorization bypass vulnerability exists in the Management Server handling of Brocade Fabric OS versions be…

    Brocade Fabric OS
  • High 7.1
    CVE-2026-87663

    An authentication bypass and command injection vulnerability exists in the inter-switch remote execution service of Bro…

    Brocade Fabric OS
  • High 7.1
    CVE-2026-87671

    An out-of-bounds memory read vulnerability exists in the web management daemon of Brocade Fabric OS versions before 10.…

    Brocade Fabric OS
  • High 7.0
    CVE-2026-87660

    An improper file permission and missing authorization vulnerability exists in the diagnostic kernel module subsystem of…

    Brocade Fabric OS
  • High 7.0
    CVE-2026-87673

    An OS command injection vulnerability exists in maintenance command-line diagnostic utilities on Brocade Fabric OS vers…

    Brocade Fabric OS
  • Medium 6.9
    CVE-2026-87668

    A stack-based buffer overflow vulnerability exists in the diagnostic execution utility of Brocade Fabric OS versions be…

    Brocade Fabric OS
  • Medium 6.9
    CVE-2026-87676

    A stack-based buffer overflow vulnerability exists in the security library component of Brocade Fabric OS versions befo…

    Brocade Fabric OS
  • Medium 6.9
    CVE-2026-87678

    An input validation and output encoding vulnerability exists in the web management interface of Brocade Fabric OS versi…

    Brocade Fabric OS
  • Medium 6.9
    CVE-2026-94575

    A logic vulnerability in Brocade Fabric OS versions before 10.0.1 web management framework allows an authenticated, low…

    Brocade Fabric OS
  • Medium 6.9
    CVE-2026-94587

    A buffer overflow vulnerability exists in the WebTools administrative interface handling configuration download or file…

    Brocade Fabric OS
  • Medium 6.8
    CVE-2026-87661

    Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 directly accepts Apache configuration file data du…

    Brocade Fabric OS
  • Medium 6.8
    CVE-2026-87672

    An information disclosure vulnerability exists in the SupportLink diagnostic collection utilities of Brocade Fabric OS …

    Brocade Fabric OS
  • Medium 6.8
    CVE-2026-94582

    A memory buffer overflow vulnerability exists in the internal diagnostic and route validation routines used by the Fabr…

    Brocade Fabric OS
  • Medium 6.0
    CVE-2026-87665

    A stack-based buffer overflow vulnerability exists in the Internet Key Exchange (IKEv2) protocol handler on Brocade Fab…

    Brocade Fabric OS
  • Medium 5.9
    CVE-2026-94576

    An authentication logic and privilege escalation vulnerability exists in the account management interface of Brocade Fa…

    Brocade Fabric OS
  • Medium 5.7
    CVE-2026-94580

    An arbitrary file and directory deletion vulnerability exists in the REST API management interface handling USB storage…

    Brocade Fabric OS
  • Medium 5.4
    CVE-2026-87677

    An OS command injection vulnerability exists in the account management subsystem of Brocade Fabric OS versions before 9…

    Brocade Fabric OS
  • Medium 5.4
    CVE-2026-94579

    An OS command injection vulnerability exists in the PAM (Pluggable Authentication Module) session cleanup routines duri…

    Brocade Fabric OS
  • Medium 5.1
    CVE-2026-87669

    A missing authorization check in Brocade Fabric OS versions before 10.0.1 REST API interface of affected platform relea…

    Brocade Fabric OS
  • Medium 5.1
    CVE-2026-87670

    An authorization logic vulnerability exists in the Brocade Fabric OS versions before 10.0.1 REST API gateway. The inter…

    Brocade Fabric OS
  • Low 2.1
    CVE-2026-94583

    A race condition vulnerability exists in the request processing logic of the REST management interface on Brocade Fabri…

    Brocade Fabric OS
  • Low 2.1
    CVE-2026-94584

    A race condition and thread-safety vulnerability exists in the web management daemon of Brocade Fabric OS versions befo…

    Brocade Fabric OS

Revision history

  1. #1.0.0

    Initiele versie

References

  • Reference
    https://support.broadcom.com/external/content/SecurityAdvisories/0/39072
  • Reference
    https://support.broadcom.com/external/content/SecurityAdvisories/0/39073
  • Reference
    https://support.broadcom.com/external/content/SecurityAdvisories/0/39082
  • Reference
    https://support.broadcom.com/external/content/SecurityAdvisories/0/39131
  • Reference
    https://support.broadcom.com/external/content/SecurityAdvisories/0/39134
  • Reference
    https://support.broadcom.com/external/content/SecurityAdvisories/0/39135
  • Reference
    https://support.broadcom.com/external/content/SecurityAdvisories/0/39136
  • Reference
    https://support.broadcom.com/external/content/SecurityAdvisories/0/39137
  • Reference
    https://support.broadcom.com/external/content/SecurityAdvisories/0/39138
  • Reference
    https://support.broadcom.com/external/content/SecurityAdvisories/0/39139
  • Reference
    https://support.broadcom.com/external/content/SecurityAdvisories/0/39140
  • Reference
    https://support.broadcom.com/external/content/SecurityAdvisories/0/39141
  • Reference
    https://support.broadcom.com/external/content/SecurityAdvisories/0/39142
  • Reference
    https://support.broadcom.com/external/content/SecurityAdvisories/0/39143
  • Reference
    https://support.broadcom.com/external/content/SecurityAdvisories/0/39144
  • Reference
    https://support.broadcom.com/external/content/SecurityAdvisories/0/39145
  • Reference
    https://support.broadcom.com/external/content/SecurityAdvisories/0/39146
  • Reference
    https://support.broadcom.com/external/content/SecurityAdvisories/0/39147
  • Reference
    https://support.broadcom.com/external/content/SecurityAdvisories/0/39148
  • Reference
    https://support.broadcom.com/external/content/SecurityAdvisories/0/39149
  • Reference
    https://support.broadcom.com/external/content/SecurityAdvisories/0/39150
  • Reference
    https://support.broadcom.com/external/content/SecurityAdvisories/0/39151
  • Reference
    https://support.broadcom.com/external/content/SecurityAdvisories/0/39152
  • Reference
    https://support.broadcom.com/external/content/SecurityAdvisories/0/39153
  • Reference
    https://support.broadcom.com/external/content/SecurityAdvisories/0/39154
  • Reference
    https://support.broadcom.com/external/content/SecurityAdvisories/0/39155
  • Reference
    https://support.broadcom.com/external/content/SecurityAdvisories/0/39156
  • Reference
    https://support.broadcom.com/external/content/SecurityAdvisories/0/39157
  • Reference
    https://support.broadcom.com/external/content/SecurityAdvisories/0/39158
  • Reference
    https://support.broadcom.com/external/content/SecurityAdvisories/0/39159
  • Reference
    https://support.broadcom.com/external/content/SecurityAdvisories/0/39160
  • Reference
    https://support.broadcom.com/external/content/SecurityAdvisories/0/39161
  • Reference
    https://support.broadcom.com/external/content/SecurityAdvisories/0/39163
  • Reference
    https://support.broadcom.com/external/content/SecurityAdvisories/0/39164