CVE-2026-87678
An input validation and output encoding vulnerability exists in the web management interface of Brocade Fabric OS versions before 10.0.1.
Published Oct 8, 2026 · updated Oct 14, 2026 · Brocade Fabric OS
An input validation and output encoding vulnerability exists in the web management interface of Brocade Fabric OS versions before 10.0.1. When configuring Federated Authentication (FA), the system fails to sanitize the Identity Provider (IdP) issuer parameter. An authenticated administrator—or an attacker capable of supplying crafted FA configuration files during an import routine—can inject arbitrary web server directives. This can lead to service denial by preventing the web management daemon from starting, or potentially alter web server security controls.
Timeline
Detection, updates, and resolution for this record.
Oct 8, 2026 · NIST NVD
Detected
An input validation and output encoding vulnerability exists in the web management interface of Brocade Fabric OS versions before 10.0.1. When configuring Federated Authentication (FA), the system fails to sanitize the Identity Provider (IdP) issuer parameter. An authenticated administrator—or an attacker capable of supplying crafted FA configuration files during an import routine—can inject arbit
Oct 14, 2026 · NIST NVD
Updated
An input validation and output encoding vulnerability exists in the web management interface of Brocade Fabric OS versions before 10.0.1. When configuring Federated Authentication (FA), the system fails to sanitize the Identity Provider (IdP) issuer parameter. An authenticated administrator—or an attacker capable of supplying crafted FA configuration files during an import routine—can inject arbit
Affected
- cpe broadcom/fabric operating systemversion unspecified
- vendor Brocade Fabric OSversion unspecified
Sources
- CIRCL Vulnerability LookupCVE-2026-87678
An input validation and output encoding vulnerability exists in the web management interface of Brocade Fabric OS versions before 10.0.1. When configuring Federated Authentication (FA), the system fails to sanitize the Identity Provider (IdP) issuer parameter. An authenticated ad
vulnerability.circl.lu - CVE.orgCVE-2026-87678
Official CVE identifier
cve.org - FIRST EPSSCVE-2026-87678
30-day exploitation probability 0.2%
first.org - NIST NVDCVE-2026-87678
An input validation and output encoding vulnerability exists in the web management interface of Brocade Fabric OS versions before 10.0.1. When configuring Federated Authentication (FA), the system fails to sanitize the Identity Provider (IdP) issuer parameter. An authenticated ad
nvd.nist.gov