CVE-2026-87671 Denial of service in Fabric OS

High 7.1 Published 8 Oct 2026 Updated 8 Oct 2026

Unauthenticated attackers can crash the web management daemon via crafted HTTP requests, causing denial of service on Brocade Fabric OS devices.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-87671?

CVE-2026-87671 is a high-severity denial of service vulnerability in Broadcom Fabric Operating System, published on 8 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

An out-of-bounds memory read vulnerability exists in the web management daemon of Brocade Fabric OS versions before 10.0.1. Unauthenticated HTTP endpoints process specific URL query parameters without validating array index boundaries or performing numerical range checks. An unauthenticated remote attacker can exploit this issue by sending a single, crafted HTTP request containing extreme numerical values in the query string. This causes an invalid memory dereference, resulting in a crash of the web management process (Denial of Service) and potential temporary management-plane disruption.

Weakness: CWE-125

Which versions are affected by CVE-2026-87671?

It affects 1 product.

Products include Broadcom Fabric Operating System.

How do I fix CVE-2026-87671?

No fix has been published for CVE-2026-87671 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-87671 being exploited?

There is no known exploitation of CVE-2026-87671 in the wild and no public exploit code.

All Broadcom Fabric Operating System vulnerabilities

Sources

Also known as GHSA-x2jf-crhc-7p49.