{"schemaVersion":3,"id":"CVE-2026-87685","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"An arbitrary file manipulation vulnerability exists in the WebTools management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When processing configuration transfer requests, the application fails to properly validate and sanitize a user-supplied status file path parameter. An authenticated administrative user can exploit this issue by submitting a specially crafted status file parameter, causing the underlying process to move an arbitrary system file to a predictable, world-readable temporary directory. This can lead to persistent Denial of Service (DoS), critical system file destruction, host compromise, or sensitive data leakage.","dates":{"published":"2026-10-08T03:24:23.925Z","modified":"2026-10-09T03:55:40.663Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":8.4,"severity":"high","version":"4.0","versionLabel":"v4.0","source":"CVE.org","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"4.0","versionLabel":"v4.0","source":"CVE.org","score":8.4,"severity":"high","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":false},{"version":"4.0","versionLabel":"v4.0","source":"NVD","score":8.4,"severity":"high","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":6.8,"severity":"medium","vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00183,"percentile":0.07516,"severity":"low","asOf":"2026-10-21T00:00:00.000Z","change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[{"date":"2026-10-08T00:00:00.000Z","score":0.00146,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00146,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00146,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00146,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00146,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00146,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00146,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00183,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00183,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00183,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00183,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00183,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00183,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00183,"percentile":0.07516}],"last30":[{"date":"2026-10-08T00:00:00.000Z","score":0.00146,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00146,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00146,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00146,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00146,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00146,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00146,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00183,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00183,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00183,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00183,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00183,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00183,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00183,"percentile":0.07516}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-73","name":"External Control of File Name or Path","description":"The product allows user input to control or influence paths or file names that are used in filesystem operations.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/73.html"}],"affected":[{"vendor":"broadcom","product":"fabric_operating_system","name":"fabric operating system","label":"fabric_operating_system","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< 9.2.2d","noFixRecorded":false,"fixedIn":null},{"text":"≥ 10.0.0, < 10.0.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.2.2d | ≥ 10.0.0, < 10.0.1","eol":null,"hubHref":"/vendor/broadcom/fabric_operating_system"},{"vendor":"brocade","product":"fabric_os","name":"fabric os","label":"fabric_os","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< 9.2.2d","noFixRecorded":false,"fixedIn":null},{"text":"≥ 10.0.0, ≤ 10.0.0a1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.2.2d | ≥ 10.0.0, ≤ 10.0.0a1","eol":null,"hubHref":"/vendor/brocade/fabric_os"}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://support.broadcom.com/external/content/SecurityAdvisories/0/39079","label":"support.broadcom.com/external/content/SecurityAdvisories/0/39079","hostname":"support.broadcom.com","tags":["Vendor Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-10-08T03:24:23.925Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-10-09T03:55:40.663Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":34,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T09:08:44.306Z","stale":false,"partial":false}}