CVE-2026-87680CWE-78command-injection

CVE-2026-87680

High · published October 8, 2026

CVSS v3.1
8.8
EPSS
2%
Percentile
79.7
In the wild
Unconfirmed
What it is

A command injection vulnerability in the REST API management interface of Brocade Fabric OS versions before 10.0.1 allows an authenticated user to execute arbitrary system commands via crafted input parameters.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
8.5 · CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.01913 · 79.7th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-10-08T05:16Z
Affected products (1)
ProductVersionsFixed in
broadcom/fabric_operating_system< 10.0.110.0.1
References (1)
https://support.broadcom.com/external/content/SecurityAdvisories/0/39074 · [email protected]
EPSS history
Timeline
  • 09 OCT 03:32Z
    EPSS moved — → 1%
    epss
  • 08 OCT 00:51Z
    A command injection vulnerability in the REST API management interface of Brocade Fabric OS versions before 10.0.1 allows an authenticated user to execute…
    cvelistv5
  • 08 OCT 00:51Z
    A command injection vulnerability in the REST API management interface of Brocade Fabric OS versions before 10.0.1 allows an authenticated user to execute…
    cvelistv5