CVE-2026-87670

Katalog CVE

CVSS 4.3 · Medium EPSS 0,14%

Kerentanan Authentication Bypass by Spoofing pada broadcom fabric operating system. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

An authorization logic vulnerability exists in the Brocade Fabric OS versions before 10.0.1 REST API gateway. The internal gate guarding restricted management endpoints relies exclusively on client-controlled HTTP headers. An authenticated user with any valid REST session can spoof these headers to gain unauthorized access to internal management endpoints. This allows low-privilege users to view sensitive chassis metadata, hardware memory patrolling state, and firmware integrity audit logs.

Rincian

Terbit di NVD

8 Oktober 2026

Terakhir diubah

13 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-290: Authentication Bypass by Spoofing

EPSS (30 hari)

0,14% peluang dieksploitasi; lebih tinggi dari 2,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://support.broadcom.com/external/content/SecurityAdvisories/0/39140 advisory vendor