Broadcom Fabric OS up to 9.2.2c/10.0.0a1 Security Certificate Management input validation

Summaryinfo

A vulnerability identified as very critical has been detected in Broadcom Fabric OS up to 9.2.2c/10.0.0a1. The impacted element is an unknown function of the component Security Certificate Management. The manipulation leads to input validation. This vulnerability is referenced as CVE-2026-87688. Remote exploitation of the attack is possible. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as very critical, has been found in Broadcom Fabric OS up to 9.2.2c/10.0.0a1. This issue affects some unknown functionality of the component Security Certificate Management. The manipulation with an unknown input leads to a input validation vulnerability. Using CWE to declare the problem leads to CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

An input validation vulnerability exists in the security certificate management component of the Brocade Fabric OS administrative management API. When processing certificate management operations, user-supplied certificate identifiers are handled without adequate sanitization prior to execution in external system routines. An authenticated attacker with privileges to perform certificate deletion requests can leverage this flaw to execute arbitrary system commands with the privileges of the underlying management daemon. This vulnerability affects Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1.

It is possible to read the advisory at support.broadcom.com. The identification of this vulnerability is CVE-2026-87688 since 09/09/2026. The exploitation is known to be easy. The attack may be initiated remotely. The exploitation requires an enhanced level of successful authentication. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/08/2026).

Upgrading to version 9.2.2d eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Broadcom

Name

• Fabric OS

Version

• 9.2.2a
• 9.2.2b
• 9.2.2c
• 10.0.0a1

License

• commercial

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion