CVE-2026-87678

An input validation and output encoding vulnerability exists in the web management interface of Brocade Fabric OS versions before 10.0.1. When configuring Federated Authentication (FA), the system fails to sanitize the Identity Provider (IdP) issuer parameter. An authenticated administrator—or an attacker capable of supplying crafted FA configuration files during an import routine—can inject arbitrary web server directives. This can lead to service denial by preventing the web management daemon from starting, or potentially alter web server security controls.

• CWE-93

• https://support.broadcom.com/external/content/SecurityAdvisories/0/39138Vendor Advisory

Published

Oct 8, 2026

Last Modified

Oct 14, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-87672An information disclosure vulnerability exists in the Suppor…5.5
• CVE-2026-87673An OS command injection vulnerability exists in maintenance …7.2
• CVE-2026-87674A local privilege escalation vulnerability exists in the sys…7.8
• CVE-2026-87675An OS command injection vulnerability exists in the configur…6.8
• CVE-2026-87676A stack-based buffer overflow vulnerability exists in the se…5.7
• CVE-2026-87677An OS command injection vulnerability exists in the account …6.6
• CVE-2026-87679When Brocade Fabric OS versions before 10.0.1 processes trun…7.2
• CVE-2026-8768A vulnerability was found in vercel ai up to 3.0.97. The aff…7.3
• CVE-2026-87680A command injection vulnerability in the REST API management…8.8
• CVE-2026-87681An Access Control Bypass vulnerability exists in the Role-Ba…6.3
• CVE-2026-87682Multiple OS Command Injection vulnerabilities exist in the m…8.8
• CVE-2026-87683Multiple stack-based buffer overflow vulnerabilities exist i…8.8