CVE-2026-87684 is a critical (CVSS 9.8) stack-based buffer overflow in the SNMP daemon of Brocade Fabric OS before 10.0.1. A remote, unauthenticated attacker under the default configuration can send a crafted SNMPv3 packet to cause a crash or possibly run code. Upgrade to 10.0.1 or later.
What's affected
The record lists Brocade Fabric OS versions before 10.0.1 from Broadcom. The vulnerable code is the SNMP daemon handling of SNMPv3 packets, where a statistics handler copies a context name into a fixed-size buffer without checking its length.
The record says the attack works without authentication under the default configuration. The Broadcom advisory could not be loaded when this guide was written, so read it for exact release trains and any configuration that limits exposure.
How to check if you're exposed
On each switch, read the firmware version:
firmwareshow
Then find out who can reach the SNMP service. Review access control lists on the management interfaces, and look at where your monitoring servers sit. Any network path from a user or lab segment to switch management is worth closing.
What to do now
- Inventory switches and firmware versions.
- Upgrade to Fabric OS 10.0.1 or later, or the fixed release in the advisory.
- Limit SNMP access to the monitoring hosts that need it, using access lists on the management network.
- Watch for unexpected daemon restarts or switch instability, which the record lists as one outcome.
- Confirm SNMPv3 credentials and community settings follow your standards.
Why it matters
The weakness is CWE-121 (stack-based buffer overflow). The code copied user-supplied data into a buffer of fixed size without checking the length. On the stack, that can overwrite control data, which is why the record lists crash and possible code execution.
Management protocols like SNMP are often reachable from many hosts and run with high privilege, which makes memory safety bugs in them serious. Network segmentation for management interfaces is a standing control that helps against this class of bug.
The record does not mark this CVE as known exploited, and it is not in the CISA KEV list.
Quick check
Do I need valid SNMP credentials to be at risk?
The record says an unauthenticated attacker can reach the flaw under the default configuration.
If you want a quick look at your own dependencies, the free in-browser scan at gold.safeguard.sh/scan needs no repository access.
Sources
Listed in the record but not readable when this guide was written, so confirm details there:
Last reviewed: 19 October 2026.
