# cve.now: Brocade

The newest entries naming Brocade as an affected vendor (up to 200), of 151 in all, 1 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-87428](https://cve.now/CVE-2026-87428.md): In Brocade ASCG before 3.5.0, a local unauthorized user on the ASCG VM who can issue a request to the SANnav host network namespace can ext (CVSS 8.4)
- [CVE-2026-87426](https://cve.now/CVE-2026-87426.md): An unauthenticated network-based attacker can query specific internal management endpoints on Brocade ASCG versions before 3.5.0 to enumerat (CVSS 5.3)
- [CVE-2026-87425](https://cve.now/CVE-2026-87425.md): An unauthenticated remote attacker can modify the TLS client trust store in Brocade ASCG versions before 3.5.0. (CVSS 7.6)
- [CVE-2026-87424](https://cve.now/CVE-2026-87424.md): A vulnerability in the SupportLink API authentication component of Brocade ASCG versions prior to 3.5.0 allows an attacker to bypass authent (CVSS 8.6)
- [CVE-2026-85490](https://cve.now/CVE-2026-85490.md): When Brocade ASCG before 3.5.0 processes support bundle archives ingested from remote compromised endpoints, the application fails to saniti (CVSS 7.7)
- [CVE-2026-85489](https://cve.now/CVE-2026-85489.md): An authentication flaw exists in the Brocade ASCG administrative management service component. (CVSS 8.7)
- [CVE-2026-85488](https://cve.now/CVE-2026-85488.md): Brocade ASCG before 3.5.0 has a well-known Brocade default password embedded in a script distributed to every customer. (CVSS 7.0)
- [CVE-2026-85487](https://cve.now/CVE-2026-85487.md): A path traversal vulnerability exists in the HTTP service component of Brocade ASCG versions before 3.5.0. (CVSS 8.6)
- [CVE-2026-85486](https://cve.now/CVE-2026-85486.md): Brocade ASCG before 3.5.0 improperly processes user input by evaluating form data prior to validation. (CVSS 8.6)
- [CVE-2026-85423](https://cve.now/CVE-2026-85423.md): A vulnerability has been identified in the data collection service of Brocade ASCG versions before 3.5.0. (CVSS 8.6)
- [CVE-2026-85422](https://cve.now/CVE-2026-85422.md): A vulnerability in Brocade ASCG version before 3.5.0 could allow an attacker to obtain a static cryptographic key hardcoded into the softwar (CVSS 8.4)
- [CVE-2026-85421](https://cve.now/CVE-2026-85421.md): A critical security vulnerability has been identified in Brocade ASCG versions before 3.5.0. (CVSS 8.7)
- [CVE-2026-5769](https://cve.now/CVE-2026-5769.md): A vulnerability in Brocade SANnav before 3.0.1 can have the Brocade Fabric OS switch admin password captured in plaintext within a memory sw (CVSS 5.6)
- [CVE-2026-5049](https://cve.now/CVE-2026-5049.md): A path traversal vulnerability affects the The Zone Alias Import flow feature in Brocade SANnav before 3.0.0a. (CVSS 6.9)
- [CVE-2026-5048](https://cve.now/CVE-2026-5048.md): In Brocade SANnav before 3.0.0a, an SQL Injection vulnerability in various external API inventories have a vulnerability that allows an auth (CVSS 6.1)
- [CVE-2026-5047](https://cve.now/CVE-2026-5047.md): A vulnerability in Brocade SANnav before 2.4.0b and 3.0.0 prints encoded passwords and authentication tokens in log files. (CVSS 8.2)
- [CVE-2023-5649](https://cve.now/CVE-2023-5649.md): An Improper Input Validation vulnerability for the registered case credentials in Brocade ASCG before v3.0 could allow a local authenticated (CVSS 6.8)
- [CVE-2023-5648](https://cve.now/CVE-2023-5648.md): In Brocade ASCG before Brocade ASCG v3.0, several security-related HTTP Headers were missing in various Brocade ASCG URL paths, aiding unaut (CVSS 6.5)
- [CVE-2026-94585](https://cve.now/CVE-2026-94585.md): An authentication bypass vulnerability exists in the web management interface of Brocade Fabric OS versions before 9.2.2d running on the MXG (CVSS 7.7)
- [CVE-2026-94587](https://cve.now/CVE-2026-94587.md): A buffer overflow vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operations (CVSS 6.9)
- [CVE-2026-94579](https://cve.now/CVE-2026-94579.md): An OS command injection vulnerability exists in the PAM (Pluggable Authentication Module) session cleanup routines during SSH session termin (CVSS 5.4)
- [CVE-2026-94576](https://cve.now/CVE-2026-94576.md): An authentication logic and privilege escalation vulnerability exists in the account management interface of Brocade Fabric OS versions befo (CVSS 5.9)
- [CVE-2026-87661](https://cve.now/CVE-2026-87661.md): Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 directly accepts Apache configuration file data during service setup or (CVSS 6.8)
- [CVE-2026-87677](https://cve.now/CVE-2026-87677.md): An OS command injection vulnerability exists in the account management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 thro (CVSS 5.4)
- [CVE-2026-94586](https://cve.now/CVE-2026-94586.md): A command injection vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operation (CVSS 8.5)
- [CVE-2026-94581](https://cve.now/CVE-2026-94581.md): An OS command injection vulnerability exists in the REST API management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 thr (CVSS 8.5)
- [CVE-2026-94577](https://cve.now/CVE-2026-94577.md): A privilege escalation vulnerability exists in the internal Command-Line Interface (CLI) authorization handling mechanism of Brocade Fabric (CVSS 7.3)
- [CVE-2026-87664](https://cve.now/CVE-2026-87664.md): A session context forgery vulnerability exists in the web management daemon of Brocade Fabric OS versions 9.2.2d and 10.0.0 through 10.0.0a1 (CVSS 8.5)
- [CVE-2026-87663](https://cve.now/CVE-2026-87663.md): An authentication bypass and command injection vulnerability exists in the inter-switch remote execution service of Brocade Fabric OS versio (CVSS 7.1)
- [CVE-2026-87662](https://cve.now/CVE-2026-87662.md): Brocade Fabric versions before 9.2.2d and 10.0.0 through 10.0.0a1 handling of specific download protocols utilizes unsanitized parameter str (CVSS 7.0)
- [CVE-2026-87660](https://cve.now/CVE-2026-87660.md): An improper file permission and missing authorization vulnerability exists in the diagnostic kernel module subsystem of Brocade Fabric OS ve (CVSS 7.0)
- [CVE-2026-87667](https://cve.now/CVE-2026-87667.md): An argument injection vulnerability exists in the configuration management command-line utility of Brocade Fabric OS versions before 9.2.2d (CVSS 8.4)
- [CVE-2026-87666](https://cve.now/CVE-2026-87666.md): An OS command injection vulnerability exists in the time and zone management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0. (CVSS 8.6)
- [CVE-2026-87675](https://cve.now/CVE-2026-87675.md): An OS command injection vulnerability exists in the configuration management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0. (CVSS 7.3)
- [CVE-2026-87674](https://cve.now/CVE-2026-87674.md): A local privilege escalation vulnerability exists in the system logging daemon of Brocade Fabric OS versions before 9.2.2d and 10.0.0 throug (CVSS 8.5)
- [CVE-2026-87673](https://cve.now/CVE-2026-87673.md): An OS command injection vulnerability exists in maintenance command-line diagnostic utilities on Brocade Fabric OS versions before 9.2.2d an (CVSS 7.0)
- [CVE-2026-87687](https://cve.now/CVE-2026-87687.md): An authorization and input validation vulnerability exists in Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. (CVSS 8.5)
- [CVE-2026-87685](https://cve.now/CVE-2026-87685.md): An arbitrary file manipulation vulnerability exists in the WebTools management interface of Brocade Fabric OS versions before 9.2.2d and 10. (CVSS 8.4)
- [CVE-2026-87688](https://cve.now/CVE-2026-87688.md): An input validation vulnerability exists in the security certificate management component of the Brocade Fabric OS administrative management (CVSS 8.5)
- [CVE-2026-94584](https://cve.now/CVE-2026-94584.md): A race condition and thread-safety vulnerability exists in the web management daemon of Brocade Fabric OS versions before 10.0.1. (CVSS 2.1)
- [CVE-2026-94580](https://cve.now/CVE-2026-94580.md): An arbitrary file and directory deletion vulnerability exists in the REST API management interface handling USB storage operations on Brocad (CVSS 5.7)
- [CVE-2026-94575](https://cve.now/CVE-2026-94575.md): A logic vulnerability in Brocade Fabric OS versions before 10.0.1 web management framework allows an authenticated, low-privileged user to b (CVSS 6.9)
- [CVE-2026-94583](https://cve.now/CVE-2026-94583.md): A race condition vulnerability exists in the request processing logic of the REST management interface on Brocade Fabric OS versions before (CVSS 2.1)
- [CVE-2026-94582](https://cve.now/CVE-2026-94582.md): A memory buffer overflow vulnerability exists in the internal diagnostic and route validation routines used by the Fabric Shortest Path Firs (CVSS 6.8)
- [CVE-2026-87668](https://cve.now/CVE-2026-87668.md): A stack-based buffer overflow vulnerability exists in the diagnostic execution utility of Brocade Fabric OS versions before 10.0.1. (CVSS 6.9)
- [CVE-2026-87665](https://cve.now/CVE-2026-87665.md): A stack-based buffer overflow vulnerability exists in the Internet Key Exchange (IKEv2) protocol handler on Brocade Fabric OS versions befor (CVSS 6.0)
- [CVE-2026-87672](https://cve.now/CVE-2026-87672.md): An information disclosure vulnerability exists in the SupportLink diagnostic collection utilities of Brocade Fabric OS versions before 10.0. (CVSS 6.8)
- [CVE-2026-87670](https://cve.now/CVE-2026-87670.md): An authorization logic vulnerability exists in the Brocade Fabric OS versions before 10.0.1 REST API gateway. (CVSS 5.1)
- [CVE-2026-87669](https://cve.now/CVE-2026-87669.md): A missing authorization check in Brocade Fabric OS versions before 10.0.1 REST API interface of affected platform releases allows an authent (CVSS 5.1)
- [CVE-2026-87678](https://cve.now/CVE-2026-87678.md): An input validation and output encoding vulnerability exists in the web management interface of Brocade Fabric OS versions before 10.0.1. (CVSS 6.9)
- [CVE-2026-87676](https://cve.now/CVE-2026-87676.md): A stack-based buffer overflow vulnerability exists in the security library component of Brocade Fabric OS versions before 10.0.1. (CVSS 6.9)
- [CVE-2026-87686](https://cve.now/CVE-2026-87686.md): An authentication and access control bypass vulnerability exists in the web server management interface of Brocade Fabric OS versions before (CVSS 5.3)
- [CVE-2026-94578](https://cve.now/CVE-2026-94578.md): Brocade Fabric OS versions before 10.0.1 contain an authorization logic vulnerability in the AAA (Authentication, Authorization, and Account (CVSS 7.5)
- [CVE-2026-87659](https://cve.now/CVE-2026-87659.md): A critical authorization bypass vulnerability exists in the Management Server handling of Brocade Fabric OS versions before 10.0.1. (CVSS 7.1)
- [CVE-2026-87671](https://cve.now/CVE-2026-87671.md): An out-of-bounds memory read vulnerability exists in the web management daemon of Brocade Fabric OS versions before 10.0.1. (CVSS 7.1)
- [CVE-2026-87684](https://cve.now/CVE-2026-87684.md): A stack-based buffer overflow vulnerability exists in the SNMP daemon request handling of Brocade Fabric versions before 10.0.1. (CVSS 8.7)
- [CVE-2026-87683](https://cve.now/CVE-2026-87683.md): Multiple stack-based buffer overflow vulnerabilities exist in the REST API management component of Brocade Fabric OS versions prior to 10.0. (CVSS 8.6)
- [CVE-2026-87682](https://cve.now/CVE-2026-87682.md): Multiple OS Command Injection vulnerabilities exist in the management interface and session processing routines of Brocade Fabric OS version (CVSS 8.6)
- [CVE-2026-87681](https://cve.now/CVE-2026-87681.md): An Access Control Bypass vulnerability exists in the Role-Based Access Control (RBAC) validation engine of Brocade Fabric OS versions before (CVSS 7.1)
- [CVE-2026-87680](https://cve.now/CVE-2026-87680.md): A command injection vulnerability in the REST API management interface of Brocade Fabric OS versions before 10.0.1 allows an authenticated u (CVSS 8.5)
- [CVE-2026-87679](https://cve.now/CVE-2026-87679.md): When Brocade Fabric OS versions before 10.0.1 processes trunk configuration operations, the application parses user-supplied list strings in (CVSS 8.5)
- [CVE-2026-85417](https://cve.now/CVE-2026-85417.md): Incomplete property masking in the SANnav logging subsystem (CVSS 6.4)
- [CVE-2026-14441](https://cve.now/CVE-2026-14441.md): Logic flaw in SANnav Java cache key handling object comparison handling (CVSS 6.9)
- [CVE-2026-14442](https://cve.now/CVE-2026-14442.md): Information exposure vulnerability in the job scheduling component of SANnav before 3.0.1a (CVSS 6.9)
- [CVE-2026-14443](https://cve.now/CVE-2026-14443.md): Incomplete log sanitization during bulk IPsec policy collection in Brocade SANnav before 3.0.1a (CVSS 8.4)
- [CVE-2026-82372](https://cve.now/CVE-2026-82372.md): Improper handling of sensitive data during IPsec policy creation and modification in Brocade SANnav before 3.0.1.a (CVSS 8.5)
- [CVE-2026-82371](https://cve.now/CVE-2026-82371.md): Plaintext exposure of sensitive authentication data in SANnav discovery service log files (CVSS 8.5)
- [CVE-2026-82370](https://cve.now/CVE-2026-82370.md): Unauthenticated remote command injection in the Brocade SANnav orchestrator HTTP service (CVSS 8.6)
- [CVE-2026-82369](https://cve.now/CVE-2026-82369.md): Insufficient input sanitization of shell metacharacters in Brocade SANnav before 3.0.1a (CVSS 8.6)
- [CVE-2026-82368](https://cve.now/CVE-2026-82368.md): Insecure access controls on internal service ports in Brocade SANnav versions before 3.0.1a allow local, non-administrative host users to co (CVSS 8.7)
- [CVE-2026-0869](https://cve.now/CVE-2026-0869.md): Application User custom defined accounts are not properly password protected in Brocade ASCG 3.4.0 (CVSS 8.3)
- [CVE-2025-58381](https://cve.now/CVE-2025-58381.md): Directory transversal vulnerability in Brocade Fabric OS before 9.2.1c2 and 9.2.2 through 9.2.2a using various shell commands (CVSS 4.6)
- [CVE-2025-9711](https://cve.now/CVE-2025-9711.md): Privilege escalation in Brocade Fabric OS before 9.2.1c3, and 9.2.2 though 9.2.2b (CVSS 8.5)
- [CVE-2025-58380](https://cve.now/CVE-2025-58380.md): Directory transversal vulnerability in Brocade Fabric OS before 9.2.1 using grep command (CVSS 4.6)
- [CVE-2026-0383](https://cve.now/CVE-2026-0383.md): Information disclosure in Brocade Fabric OS before 9.2.1c2, 9.2.2 through 9.2.2a and 10.0.0 (CVSS 8.2)
- [CVE-2025-58379](https://cve.now/CVE-2025-58379.md): Password Exposure in Brocade Fabric OS (CVSS 6.0)
- [CVE-2025-58383](https://cve.now/CVE-2025-58383.md): Privilege escalation via bind command in Brocade Fabric OS (CVSS 8.4)
- [CVE-2025-58382](https://cve.now/CVE-2025-58382.md): Privilege escalation in Brocade Fabric before 9.2.1c2 and 9.2.2 through 9.2.2a (CVSS 8.5)
- [CVE-2025-12774](https://cve.now/CVE-2025-12774.md): SQL queries with sensitive information printed in logs with Brocade SANnav before 3.0 (CVSS 4.6)
- [CVE-2025-12773](https://cve.now/CVE-2025-12773.md): Plain password is generated in the audit logs while executing update-reports-purge-settings.sh script with Brocade SANnav before 2.4.0a (CVSS 7.1)
- [CVE-2025-12772](https://cve.now/CVE-2025-12772.md): Plaintext Switch admin login password is seen in Brocade SANnav support save (CVSS 8.5)
- [CVE-2025-12679](https://cve.now/CVE-2025-12679.md): Plain text pbe key visible in audit log during Brocade SANnav migration from 2.4.0a to 3.0.0 (CVSS 7.1)
- [CVE-2025-12680](https://cve.now/CVE-2025-12680.md): Brocade SANnav DataBase plaintext password is logged in failover logs (CVE-2025-12680) (CVSS 6.0)
- [CVE-2025-4661](https://cve.now/CVE-2025-4661.md): Path transversal vulnerability potentially leading to sensitive information disclosure (CVSS 4.8)
- [CVE-2025-1976](https://cve.now/CVE-2025-1976.md): Code injection exposure in Fabric OS 9.1.0 through 9.1.1d6 (CVSS 8.6, KEV)
- [CVE-2024-1509](https://cve.now/CVE-2024-1509.md): Brocade ASCG 3.2.0 web interface does not enforce HSTS, as defined by RFC 6797 for ports 8030 and 8100 (CVSS 7.6)
- [CVE-2024-5461](https://cve.now/CVE-2024-5461.md): Command or parameter injection via unique embedded switch SNMP commands. (CVSS 8.6)
- [CVE-2024-5462](https://cve.now/CVE-2024-5462.md): Brocade Fabric OS may capture SNMP Passwords in clear text (CVSS 5.3)
- [CVE-2024-4282](https://cve.now/CVE-2024-4282.md): Weak TLS Ciphers on Brocade SANnav OVA SSH port 22 (CVSS 8.2)
- [CVE-2024-10405](https://cve.now/CVE-2024-10405.md): Weak TLS Ciphers on Brocade SANnav port 443 & 18082 (CVSS 6.9)
- [CVE-2024-2240](https://cve.now/CVE-2024-2240.md): Docker implementation in Brocade SANnav is missing Audit Rules. (CVSS 8.6)
- [CVE-2025-1053](https://cve.now/CVE-2025-1053.md): Brocade SANnav encryption key is logged in the debug logs (CVSS 8.6)
- [CVE-2024-10404](https://cve.now/CVE-2024-10404.md): Clear text password seen in switch-asset-collectors-mw in Brocade SANnav supportsave (CVSS 5.5)
- [CVE-2024-7517](https://cve.now/CVE-2024-7517.md): Privileged escalation via crafted use of portcfg command (CVSS 8.5)
- [CVE-2024-10403](https://cve.now/CVE-2024-10403.md): SFTP/FTP password could be captured in plain text in Supportsave generated from SANnav (CVSS 5.9)
- [CVE-2022-43937](https://cve.now/CVE-2022-43937.md): Brocade SANnav Information Disclosure Vulnerability (CVSS 5.7)
- [CVE-2022-43936](https://cve.now/CVE-2022-43936.md): Brocade Fabric OS switch passwords when debugging is enabled (CVSS 6.8)
- [CVE-2022-43935](https://cve.now/CVE-2022-43935.md): Switch passwords and authorization IDs are printed in the embedded MLS DB file (CVSS 5.3)
- [CVE-2022-43934](https://cve.now/CVE-2022-43934.md): Weak Key-exchange algorithms (CVSS 6.5)
- [CVE-2022-43933](https://cve.now/CVE-2022-43933.md): configuration secrets are logged in support-save (CVSS 4.4)
- [CVE-2024-7516](https://cve.now/CVE-2024-7516.md): Brocade Fabric OS before 9.2.2 does not enforce strict host key checking (CVSS 7.0)
- [CVE-2024-5460](https://cve.now/CVE-2024-5460.md): Brocade Fabric OS versions prior to v9.0 have default community strings (CVSS 8.1)
- [CVE-2024-29954](https://cve.now/CVE-2024-29954.md): password management API prints sensitive information in log files (CVSS 5.9)
- [CVE-2024-29953](https://cve.now/CVE-2024-29953.md): Encoded session passwords on session storage for Virtual Fabric platforms (CVSS 4.3)
- [CVE-2024-2860](https://cve.now/CVE-2024-2860.md): The PostgreSQL implementation in Brocade SANnav versions before 2.3.0a is vulnerable to an incorrect local authentication flaw. (CVSS 7.8)
- [CVE-2024-2859](https://cve.now/CVE-2024-2859.md): By default, SANnav OVA is shipped with root user login enabled (CVE-2024-2859) (CVSS 6.8)
- [CVE-2024-4173](https://cve.now/CVE-2024-4173.md): SANnav versions exposes Kafka in the wan interface. (CVSS 7.6)
- [CVE-2024-4161](https://cve.now/CVE-2024-4161.md): Syslog traffic sent in clear-text (CVSS 8.6)
- [CVE-2024-4159](https://cve.now/CVE-2024-4159.md): Protection mechanisms (CVSS 4.3)
- [CVE-2024-29969](https://cve.now/CVE-2024-29969.md): TLS/SSL weak message authentication code ciphers are added by default for port 18082 (CVSS 7.5)
- [CVE-2024-29968](https://cve.now/CVE-2024-29968.md): SQL Table names, column names, and SQL queries are collected in DR standby Supportsave (CVSS 7.7)
- [CVE-2024-29967](https://cve.now/CVE-2024-29967.md): In Brocade SANnav before v2.31 and v2.3.0a, it was observed that Docker instances inside the appliance have insecure mount points (CVSS 4.4)
- [CVE-2024-29966](https://cve.now/CVE-2024-29966.md): hard-coded credentials in the documentation that appear as the appliance root password (CVSS 7.5)
- [CVE-2024-29965](https://cve.now/CVE-2024-29965.md): Insecure backup (CVSS 6.8)
- [CVE-2024-29964](https://cve.now/CVE-2024-29964.md): Brocade SANnav versions before v2.3.0a do not correctly set permissions on files, including docker files (CVSS 5.7)
- [CVE-2024-29962](https://cve.now/CVE-2024-29962.md): Insecure file permission setting that makes files world-readable (CVSS 5.5)
- [CVE-2024-29963](https://cve.now/CVE-2024-29963.md): Brocade SANnav contains hardcoded TLS keys used by Docker (CVSS 1.9)
- [CVE-2024-29961](https://cve.now/CVE-2024-29961.md): supply-chain attack risk (CVSS 8.2)
- [CVE-2024-29960](https://cve.now/CVE-2024-29960.md): Identical SSH keys utilized inside the OVA image (CVE-2024-29960) (CVSS 6.8)
- [CVE-2024-29959](https://cve.now/CVE-2024-29959.md): Brocade Fabric OS switch encrypted passwords in the Brocade SANnav Standby node's support save (CVSS 8.6)
- [CVE-2024-29958](https://cve.now/CVE-2024-29958.md): Encryption key in the console when a privileged user executes the script to replace the Brocade SANnav Management Portal standby node. (CVSS 7.5)
- [CVE-2024-29957](https://cve.now/CVE-2024-29957.md): Encryption key is stored in the DR log files (CVSS 7.5)
- [CVE-2024-29956](https://cve.now/CVE-2024-29956.md): cleartext password in supportsave logs when a user schedules a switch Supportsave from Brocade SANnav (CVSS 6.5)
- [CVE-2024-29955](https://cve.now/CVE-2024-29955.md): Insertion of Sensitive Information into Brocade SANnav Log File (CVSS 5.0)
- [CVE-2024-29952](https://cve.now/CVE-2024-29952.md): Clear text storage of sensistive information by manipulating command variables (CVSS 5.5)
- [CVE-2024-29951](https://cve.now/CVE-2024-29951.md): Brocade SANnav has weak encryption in internal SSH ports (CVSS 5.7)
- [CVE-2024-29950](https://cve.now/CVE-2024-29950.md): Brocade SANnav before v2.3.1, v2.3.0a uses weak encryption (CVSS 7.5)
- [CVE-2023-5973](https://cve.now/CVE-2023-5973.md): Truncated port name (CVSS 4.3)
- [CVE-2023-3454](https://cve.now/CVE-2023-3454.md): Remote code execution (RCE) vulnerability in Brocade Fabric OS after v9.0 and before v9.2.0 could allow an attacker to execute arbitrary cod (CVSS 8.6)
- [CVE-2021-27795](https://cve.now/CVE-2021-27795.md): License forgery in Brocade Fabric OS (FOS) hardware platforms running any version of Brocade Fabric OS software, (CVSS 6.4)
- [CVE-2023-31424](https://cve.now/CVE-2023-31424.md): Web authentication and authorization bypass (CVSS 8.1)
- [CVE-2023-31423](https://cve.now/CVE-2023-31423.md): Possible information exposure through log file vulnerability (CVSS 5.7)
- [CVE-2023-31925](https://cve.now/CVE-2023-31925.md): Storage of clear text password in Brocade SANnav (CVSS 5.4)
- [CVE-2023-4162](https://cve.now/CVE-2023-4162.md): Segmentation fault in Brocade Fabric OS after Brocade Fabric OS v9.0 (CVSS 4.4)
- [CVE-2023-4163](https://cve.now/CVE-2023-4163.md): Possible buffer overflow in portcfgfportbuffers in Brocade Fabric OS (CVSS 4.4)
- [CVE-2023-3489](https://cve.now/CVE-2023-3489.md): firmwaredownload command could log servers passwords in clear text (CVSS 8.6)
- [CVE-2023-31926](https://cve.now/CVE-2023-31926.md): Arbitrary File Overwrite using less command (CVSS 7.1)
- [CVE-2023-31927](https://cve.now/CVE-2023-31927.md): An information disclosure in the web interface of Brocade Fabric OS (CVSS 5.3)
- [CVE-2023-31432](https://cve.now/CVE-2023-31432.md): Privilege issues in multiple commands (CVSS 7.8)
- [CVE-2023-31928](https://cve.now/CVE-2023-31928.md): XSS vulnerability in Brocade Webtools (CVSS 6.3)
- [CVE-2023-31428](https://cve.now/CVE-2023-31428.md): CLI allows upload or transfer files of dangerous types (CVSS 5.5)
- [CVE-2023-31430](https://cve.now/CVE-2023-31430.md): buffer overflow vulnerability in “secpolicydelete” command (CVSS 5.5)
- [CVE-2023-31431](https://cve.now/CVE-2023-31431.md): A buffer overflow vulnerability in “diagstatus” command (CVSS 5.5)
- [CVE-2023-31427](https://cve.now/CVE-2023-31427.md): Knowledge of full path name (CVSS 7.8)
- [CVE-2023-31426](https://cve.now/CVE-2023-31426.md): scp, sftp, ftp servers passwords in supportsave (CVSS 6.8)
- [CVE-2023-31425](https://cve.now/CVE-2023-31425.md): Privilege escalation via the fosexec command (CVSS 7.8)
- [CVE-2023-31429](https://cve.now/CVE-2023-31429.md): Multiple commands print sensitive information in the terminal (CVSS 5.5)
- [CVE-2022-33187](https://cve.now/CVE-2022-33187.md): Brocade SANnav before v2.2.1 logs usernames and encoded passwords in debug-enabled logs (CVSS 5.5)
- [CVE-2021-27798](https://cve.now/CVE-2021-27798.md): privileged directory transversal.in Brocade Fabric OS versions 7.4.1.x and 7.3.x (no CVSS)
- [CVE-2019-16204](https://cve.now/CVE-2019-16204.md): Brocade Fabric OS Versions before v7.4.2f, v8.2.2a, v8.1.2j and v8.2.1d could expose external passwords, common secrets or authentication ke (no CVSS)
- [CVE-2019-16203](https://cve.now/CVE-2019-16203.md): Brocade Fabric OS Versions before v8.2.2a and v8.2.1d could expose the credentials of the remote ESRS server when these credentials are give (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/brocade
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.