FO
Product
Fabric Operating System
On CISA KEVExploited in the wild
146
CVEs
2
On KEV
9.8
Max CVSS
43
New 30D
Severity mix
Critical 11High 68Medium 60Low 6
Watch
Add Fabric Operating System to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-1976 In wildKEV | 6.7 | Apr 24 | Code injection exposure in Fabric OS 9.1.0 through 9.1.1d6 Affected: 9.1.0 before 9.1.1d7 |
| CVE-2026-94586 | 6.8 | Oct 8 | A command injection vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operations of Brocade Fabric OS versions before… Affected: before 9.2.2d; 10.0.0 before 10.0.1 |
| CVE-2026-94581 | 6.8 | Oct 8 | An OS command injection vulnerability exists in the REST API management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 allows an authenticated,… Affected: before 9.2.2d; 10.0.0 before 10.0.1 |
| CVE-2026-87675 | 6.8 | Oct 8 | An OS command injection vulnerability exists in the configuration management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 Affected: before 9.2.2d; 10.0.0 before 10.0.1 |
| CVE-2026-87685 | 6.8 | Oct 8 | An arbitrary file manipulation vulnerability exists in the WebTools management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 Affected: before 9.2.2d; 10.0.0 before 10.0.1 |
| CVE-2026-87688 | 6.8 | Oct 8 | An input validation vulnerability exists in the security certificate management component of the Brocade Fabric OS administrative management API Affected: before 9.2.2d; 10.0.0 before 10.0.1 |
| CVE-2026-87663 | 6.7 | Oct 8 | An authentication bypass and command injection vulnerability exists in the inter-switch remote execution service of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through… Affected: before 9.2.2d; 10.0.0 before 10.0.1 |
| CVE-2026-87662 | 6.7 | Oct 8 | Brocade Fabric versions before 9.2.2d and 10.0.0 through 10.0.0a1 handling of specific download protocols utilizes unsanitized parameter strings Affected: before 9.2.2d; 10.0.0 before 10.0.1 |
| CVE-2020-15375 | 6.7 | Dec 11 | Brocade Fabric OS versions before v9.0.0, v8.2.2c, v8.2.1e, v8.1.2k, v8.2.0_CBN3, v7.4.2g contain an improper input validation weakness in the command line interface when… Affected: before 7.4.2g; 8.0.0 before 8.1.2k; 8.2.0 before 8.2.0_cbn3; 8.2.1 before 8.2.1e; 8.2.2b before 8.2.2c |
| CVE-2026-87677 | 6.6 | Oct 8 | An OS command injection vulnerability exists in the account management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 Affected: before 9.2.2d; 10.0.0 before 10.0.1 |
| CVE-2026-87668 | 6.5 | Oct 8 | A stack-based buffer overflow vulnerability exists in the diagnostic execution utility of Brocade Fabric OS versions before 10.0.1 Affected: before 10.0.1 |
| CVE-2023-31426 | 6.5 | Aug 1 | The Brocade Fabric OS Commands “configupload” and “configdownload” before Brocade Fabric OS v9.1.1c, v8.2.3d, v9.2.0 print scp, sftp, ftp servers passwords in supportsave Affected: before 8.2.3d; 9.0.0 before 9.1.1c |
| CVE-2022-28170 | 6.5 | Oct 25 | Brocade Fabric OS Web Application services before Brocade Fabric v9.1.0, v9.0.1e, v8.2.3c, v7.4.2j store server and user passwords in the debug statements Affected: before 7.4.2j; 8.0.0 before 8.2.3c; 9.0.0 before 9.0.1e; 9.1.0 |
| CVE-2022-27776 | 6.5 | Jun 1 | A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host but another port… Affected: All versions, or not specified |
| CVE-2021-27789 | 6.5 | Mar 18 | The Web application of Brocade Fabric OS before versions Brocade Fabric OS v9.0.1a and v8.2.3a contains debug statements that expose sensitive information to the program's… Affected: before 8.2.3a; 9.0.0 before 9.0.1a |
| CVE-2020-15388 | 6.5 | Mar 18 | A vulnerability in the Brocade Fabric OS before Brocade Fabric OS v9.0.1a, v8.2.3, v8.2.0_CBN4, and v7.4.2h could allow an authenticated CLI user to abuse the history command to… Affected: before 7.4.2h; 9.0.0 before 9.0.1a; 8.2.0; 8.2.0; 8.2.0a; 8.2.3 |
| CVE-2021-27796 | 6.5 | Feb 21 | A vulnerability in Brocade Fabric OS versions before Brocade Fabric OS v8.0.1b, v7.4.1d could allow an authenticated attacker within the restricted shell environment (rbash) as… Affected: before 7.4.1d; 8.0.0 before 8.0.1b |
| CVE-2020-15370 | 6.5 | Sep 25 | Brocade Fabric OS versions before Brocade Fabric OS v7.4.2g could allow an authenticated, remote attacker to view a user password in cleartext Affected: before 7.4.2g |
| CVE-2020-13645 | 6.5 | May 28 | In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verification of the server's TLS certificate if the application fails to specify… Affected: All versions, or not specified |
| CVE-2017-6227 | 6.5 | Feb 8 | A vulnerability in the IPv6 stack on Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) versions before 7.4.2b, 8.1.2 and 8.2.0 could allow an attacker to cause a… Affected: before 7.4.2b; 8.0.0; 8.0.1; 8.0.2; 8.1.0; 8.1.1; +1 more |
| CVE-2016-4376 | 6.5 | Aug 22 | HPE FOS before 7.4.1d and 8.x before 8.0.1 on StoreFabric B switches allows remote attackers to obtain sensitive information via unspecified vectors Affected: through 7.4.1; 8.0.0 |
| CVE-2026-87681 | 6.3 | Oct 8 | An Access Control Bypass vulnerability exists in the Role-Based Access Control (RBAC) validation engine of Brocade Fabric OS versions before 10.0.1 Affected: before 10.0.1 |
| CVE-2024-24795 | 6.3 | Apr 4 | HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to cause an HTTP… Affected: All versions, or not specified |
| CVE-2018-6449 | 6.1 | Sep 25 | Host Header Injection vulnerability in the http management interface in Brocade Fabric OS versions before v9.0.0 could allow a remote attacker to exploit this vulnerability by… Affected: before 9.0.0 |
| CVE-2017-6225 | 6.1 | Feb 8 | Cross-site scripting (XSS) vulnerability in the web-based management interface of Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) versions before 7.4.2b, 8.1.2… Affected: before 7.4.2b; 8.0.2; 8.1.1 |
| CVE-2019-25013 | 5.9 | Jan 4 | The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read Affected: All versions, or not specified |
| CVE-2026-87661 | 5.7 | Oct 8 | Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 directly accepts Apache configuration file data during service setup or re-initialization Affected: before 9.2.2d; 10.0.0 before 10.0.1 |
| CVE-2026-94575 | 5.7 | Oct 8 | A logic vulnerability in Brocade Fabric OS versions before 10.0.1 web management framework allows an authenticated, low-privileged user to bypass inner Role-Based Access Control… Affected: before 10.0.1 |
| CVE-2026-87676 | 5.7 | Oct 8 | A stack-based buffer overflow vulnerability exists in the security library component of Brocade Fabric OS versions before 10.0.1 Affected: before 10.0.1 |
| CVE-2022-27774 | 5.7 | Jun 1 | An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows… Affected: All versions, or not specified |
| CVE-2026-87672 | 5.5 | Oct 8 | An information disclosure vulnerability exists in the SupportLink diagnostic collection utilities of Brocade Fabric OS versions before 10.0.1 Affected: before 10.0.1 |
| CVE-2025-58379 | 5.5 | Feb 3 | Password Exposure in Brocade Fabric OS Affected: before 9.2.1 |
| CVE-2024-29954 | 5.5 | Jun 26 | A vulnerability in a password management API in Brocade Fabric OS versions before v9.2.1, v9.2.0b, v9.1.1d, and v8.2.3e prints sensitive information in log files Affected: before 8.2.3e; 9.0.1 before 9.1.1d; 9.2.0 before 9.2.0b |
| CVE-2023-31429 | 5.5 | Aug 1 | Brocade Fabric OS before Brocade Fabric OS 9.1.1c, 9.2.0 contains a vulnerability when using various commands such as “chassisdistribute”, “reboot”, “rasman”, errmoduleshow,… Affected: before 9.1.1c |
| CVE-2022-33181 | 5.5 | Oct 25 | An information disclosure vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, 8.2.0cbn5, 7.4.2.j could allow a local authenticated attacker to… Affected: before 7.4.2.j; 8.0.0 before 8.2.3c; 9.0.0 before 9.0.1e; 9.1.0 |
| CVE-2022-33180 | 5.5 | Oct 25 | A vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, 8.2.0cbn5 could allow a local authenticated attacker to export out sensitive files with… Affected: 8.0.0 before 8.2.3c; 9.0.0 before 9.0.1e; 9.1.0 |
| CVE-2021-27798 | 5.5 | Aug 5 | privileged directory transversal.in Brocade Fabric OS versions 7.4.1.x and 7.3.x Affected: 7.3.1d; 7.4.1b |
| CVE-2020-15372 | 5.5 | Sep 25 | A vulnerability in the command-line interface in Brocade Fabric OS before Brocade Fabric OS v8.2.2a1, 8.2.2c, v7.4.2g, v8.2.0_CBN3, v8.2.1e, v8.1.2k, v9.0.0, could allow a local… Affected: before 7.4.2g; 8.0.0 before 8.1.2k; 8.2.0 before 8.2.0_cbn3; 8.2.1 before 8.2.1e; 8.2.2 before 8.2.2a1; 8.2.2b before 8.2.2c |
| CVE-2020-13631 | 5.5 | May 27 | SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c and build.c Affected: All versions, or not specified |
| CVE-2020-13632 | 5.5 | May 27 | ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo() query Affected: All versions, or not specified |
| CVE-2018-6433 | 5.5 | Nov 8 | A vulnerability in the secryptocfg export command of Brocade Fabric OS versions before 8.2.1, 8.1.2f, 8.0.2f, 7.4.2d could allow a local attacker to bypass the export file access… Affected: 7.4.2 before 7.4.2d; 8.0.2 before 8.0.2f; 8.1.2 before 8.1.2f; 8.2.0 before 8.2.1 |
| CVE-2021-27791 | 5.4 | Aug 12 | The function that is used to parse the Authentication header in Brocade Fabric OS Web application service before Brocade Fabric OS v9.0.1a and v8.2.3a fails to properly process a… Affected: 8.2.1 before 8.2.3a; 9.0.0 before 9.0.1a |
| CVE-2018-6447 | 5.4 | Sep 25 | A Reflective XSS Vulnerability in HTTP Management Interface in Brocade Fabric OS versions before Brocade Fabric OS v9.0.0, v8.2.2c, v8.2.1e, v8.1.2k, v8.2.0_CBN3, v7.4.2g could… Affected: 2.1.2; 2.2; 3.1; 5.0.5b; 5.2.0; 5.2.0a; +34 more |
| CVE-2021-27793 | 5.3 | Aug 12 | ntermittent authorization failure in aaa tacacs+ with Brocade Fabric OS versions before Brocade Fabric OS v9.0.1b and after 9.0.0, also in Brocade Fabric OS before Brocade Fabric… Affected: 8.2.0 before 8.2.3; 9.0.0 before 9.0.1; 8.2.3; 9.0.1; 9.0.1a |
| CVE-2020-15386 | 5.3 | Jun 9 | Brocade Fabric OS prior to v9.0.1a and 8.2.3a and after v9.0.0 and 8.2.2d may observe high CPU load during security scanning, which could lead to a slower response to CLI commands… Affected: 8.2.3; 9.0.0a; 9.0.0b; 9.0.1 |
| CVE-2021-22876 | 5.3 | Apr 1 | curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header Affected: All versions, or not specified |
| CVE-2026-87678 | 5.2 | Oct 8 | An input validation and output encoding vulnerability exists in the web management interface of Brocade Fabric OS versions before 10.0.1 Affected: before 10.0.1 |
| CVE-2025-4663 | 4.9 | Jul 8 | An Improper Check for Unusual or Exceptional Conditions vulnerability in Brocade Fabric OS before 9.2.2.a could allow an authenticated, network-based attacker to cause a … Affected: 9.0.0 through 9.2.1b; 9.2.2 |
| CVE-2026-94587 | 4.5 | Oct 8 | A buffer overflow vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operations of Brocade Fabric OS versions before… Affected: before 9.2.2d; 10.0.0 before 10.0.1 |
| CVE-2026-87667 | 4.5 | Oct 8 | An argument injection vulnerability exists in the configuration management command-line utility of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 Affected: before 9.2.2d; 10.0.0 before 10.0.1 |