Broadcom vulnerabilities
We track 127 vulnerabilities in Broadcom products across 31 products. 126 are rated high or critical, and 7 have been exploited in real attacks. The most recent was published on October 8, 2026.
Latest Broadcom vulnerabilities
- 9.4 Critical severity
Symantec Privileged Access Management: Improper Initialization
An improper input validation allows an unauthenticated attacker to achieve remote command execution on the affected PAM system by sending a specially crafted HTTP request.
- 8.1 High severity
Fabric OS: Use of Hard-coded Credentials
A vulnerability in the default configuration of the Simple Network Management Protocol (SNMP) feature of Brocade Fabric OS versions before v9.0.0 could allow an authenticated, remote attacker to read data from an affected device via SNMP. The vulnerability is
- 8.4 High severity
Symantec SiteMinder: Improper Neutralization of CRLF Sequences
A CRLF cross-site scripting vulnerability has been identified in certain configurations of the SiteMinder Web Agent for IIS Web Server and SiteMinder Web Agent for Domino Web Server. As a result, an attacker can execute arbitrary Javascript code in a client br
- 7.2 High severity
VMware vCenter Server: Improper Control of Generation of Code
The vCenter Server contains an authenticated remote code execution vulnerability. A malicious actor with administrative privileges on the vCenter appliance shell may exploit this issue to run arbitrary commands on the underlying operating system.
- 7.2 High severity
Brocade SANnav: Incorrect Default Permissions
By default, SANnav OVA is shipped with root user login enabled. While protected by a password, access to root could expose SANnav to a remote attacker should they gain access to the root account.
- 7.5 High severity
Brocade SANnav: Cleartext Transmission of Sensitive Information
In Brocade SANnav, before Brocade SANnav v2.3.0, syslog traffic received clear text. This could allow an unauthenticated, remote attacker to capture sensitive information.
- 7.3 High severity
Apache HTTP Server: Improper Validation of Specified Quantity in Input
Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses. This issue affects Apache HTTP Server: through 2.4.58.
- 9.8 Critical severity
Fabric OS: Improper Neutralization of Special Elements used in an OS Command
Remote code execution (RCE) vulnerability in Brocade Fabric OS after v9.0 and before v9.2.0 could allow an attacker to execute arbitrary code and use this to gain root access to the Brocade switch.
- 8.2 High severity
VMware ESXi: Out-of-bounds Write
VMware ESXi contains an out-of-bounds write vulnerability. A malicious actor with privileges within the VMX process may trigger an out-of-bounds write leading to an escape of the sandbox.
- 8.8 High severity
Data Loss Prevention: Buffer Copy without Checking Size of Input
A buffer overflow vulnerability exists in Symantec Data Loss Prevention version 14.0.2 and before. A remote, unauthenticated attacker can exploit this vulnerability by enticing a user to open a crafted document to achieve code execution.
- 9.8 Critical severity
Server Management Suite: Buffer Copy without Checking Size of Input
A buffer overflow vulnerability exists in Symantec Server Management Suite version 7.9 and before. A remote, anonymous attacker can exploit this vulnerability to achieve remote code execution as SYSTEM.
- 9.8 Critical severity
Messaging Gateway: Buffer Copy without Checking Size of Input
A buffer overflow vulnerability exists in Symantec Messaging Gateway versions 10.5 and before. A remote, anonymous attacker can exploit this vulnerability to achieve remote code execution as root.
- 9.8 Critical severity
Messaging Gateway: Buffer Copy without Checking Size of Input
A buffer overflow vulnerability exists in Symantec Messaging Gateway versions 9.5 and before. A remote, anonymous attacker can exploit this vulnerability to achieve remote code execution as root.
- 9.8 Critical severity
Deployment Solution: Buffer Copy without Checking Size of Input
A buffer overflow vulnerability exists in Symantec Deployment Solution version 7.9 when parsing UpdateComputer tokens. A remote, anonymous attacker can exploit this vulnerability to achieve remote code execution as SYSTEM.
- 7.8 High severity
lsi_pci-sv92ex_firmware: Out-of-bounds Write
An issue was discovered in Broadcom) LSI PCI-SV92EX Soft Modem Kernel Driver through 2.2.100.1 (aka AGRSM64.sys). There is Local Privilege Escalation to SYSTEM via a Stack Overflow in RTLCopyMemory (IOCTL 0x1b2150). An attacker can exploit this to elevate priv
- 9.8 Critical severity
SANnav: Authentication Bypass by Spoofing
Brocade SANnav Web interface before Brocade SANnav v2.3.0 and v2.2.2a allows remote unauthenticated users to bypass web authentication and authorization.
- 7.5 High severity
Fabric OS: Cleartext Storage of Sensitive Information
The firmwaredownload command on Brocade Fabric OS v9.2.0 could log the FTP/SFTP/SCP server password in clear text in the SupportSave file when performing a downgrade from Fabric OS v9.2.0 to any earlier version of Fabric OS.
- 7.8 High severity
Fabric OS: Improper Privilege Management
Through manipulation of passwords or other variables, using commands such as portcfgupload, configupload, license, myid, a non-privileged user could obtain root privileges in Brocade Fabric OS versions before Brocade Fabric OS v9.1.1c and v9.2.0.
- 7.8 High severity
Fabric OS: Improper Limitation of a Pathname to a Restricted Directory
Brocade Fabric OS versions before Brocade Fabric OS v9.1.1c, and v9.2.0 Could allow an authenticated, local user with knowledge of full path names inside Brocade Fabric OS to execute any command regardless of assigned privilege. Starting with Fabric OS v9.1.0,
- 7.8 High severity
Fabric OS: Improper Neutralization of Special Elements used in an OS Command
A vulnerability in the fosexec command of Brocade Fabric OS after Brocade Fabric OS v9.1.0 and, before Brocade Fabric OS v9.1.1 could allow a local authenticated user to perform privilege escalation to root by breaking the rbash shell. Starting with Fabric OS
- 8.8 High severity
https://github.com/curl/curl: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indicate a path relative to
- 7.5 High severity
Tcpreplay: NULL Pointer Dereference
An issue found in TCPReplay v.4.4.3 allows a remote attacker to cause a denial of service via the read_hexstring function at the utils.c:309 endpoint.
- 7.5 High severity
Tcpreplay: Reachable Assertion
An issue found in TCPreplay tcprewrite v.4.4.3 allows a remote attacker to cause a denial of service via the tcpedit_dlt_cleanup function at plugins/dlt_plugins.c.
- 9.8 Critical severity
Brocade Fabric OS: Improper Neutralization of Special Elements used in an OS Command
A vulnerability in Brocade Fabric OS software v9.1.1, v9.0.1e, v8.2.3c, v7.4.2j, and earlier versions could allow a remote unauthenticated attacker to execute on a Brocade Fabric OS switch commands capable of modifying zoning, disabling the switch, disabling p
- 7.8 High severity
Brocade Fabric OS: Out-of-bounds Write
Several commands in Brocade Fabric OS before Brocade Fabric OS v.9.0.1e, and v9.1.0 use unsafe string functions to process user input. Authenticated local attackers could abuse these vulnerabilities to exploit stack-based buffer overflows, allowing arbitrary c
- 7.8 High severity
Brocade Fabric OS: Out-of-bounds Write
A vulnerability in fab_seg.c.h libraries of all Brocade Fabric OS versions before Brocade Fabric OS v9.1.1, v9.0.1e, v8.2.3c, v8.2.0_cbn5, 7.4.2j could allow local authenticated attackers to exploit stack-based buffer overflows and execute arbitrary code as th
- 8.8 High severity
Brocade Fabric OS: Out-of-bounds Write
A vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, 8.2.0cbn5, 7.4.2.j could allow a remote authenticated attacker to perform stack buffer overflow using in “firmwaredownload” and “diagshow” commands.
- 7.8 High severity
Brocade Fabric OS: Incorrect Default Permissions
A privilege escalation vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, 8.2.0cbn5, could allow a local authenticated user to escalate its privilege to root using switch commands “supportlink”, “firmwaredownload”, “portcfg
- 7.2 High severity
A vulnerability in the radius authentication system of Brocade Fabric OS before Brocade Fabric…
A vulnerability in the radius authentication system of Brocade Fabric OS before Brocade Fabric OS 9.0 could allow a remote attacker to execute arbitrary code on the Brocade switch.
- 8.8 High severity
Brocade Fabric OS: Improper Privilege Management
Brocade Webtools in Brocade Fabric OS versions before Brocade Fabric OS versions v9.1.1, v9.0.1e, and v8.2.3c could allow a low privilege webtools, user, to gain elevated admin rights, or privileges, beyond what is intended or entitled for that user. By exploi
- 7.8 High severity
Tcpreplay: Out-of-bounds Write
The component tcpprep in Tcpreplay v4.4.1 was discovered to contain a heap-based buffer overflow in parse_mpls at common/get.c:150. NOTE: this is different from CVE-2022-27942.
- 7.8 High severity
Tcpreplay: Out-of-bounds Write
The component tcprewrite in Tcpreplay v4.4.1 was discovered to contain a heap-based buffer overflow in get_l2len_protocol at common/get.c:344. NOTE: this is different from CVE-2022-27941.
- 7.8 High severity
Tcpreplay: Out-of-bounds Write
The component tcprewrite in Tcpreplay v4.4.1 was discovered to contain a heap-based buffer overflow in get_ipv6_next at common/get.c:713. NOTE: this is different from CVE-2022-27940.
- 7.5 High severity
Brocade SANnav: Insecure Storage of Sensitive Information
In Brocade SANnav before Brocade SANnav v2.2.0.2 and Brocade SANnav2.1.1.8, encoded scp-server passwords are stored using Base64 encoding, which could allow an attacker able to access log files to easily decode the passwords.
- 7.5 High severity
Brocade SANnav: Use of a Broken or Risky Cryptographic Algorithm
In Brocade SANnav version before SANN2.2.0.2 and Brocade SANNav before 2.1.1.8, the implementation of TLS/SSL Server Supports the Use of Static Key Ciphers (ssl-static-key-ciphers) on ports 443 & 18082.
- 7.3 High severity
OpenSSL: Improper Neutralization of Special Elements used in an OS Command
In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was
- 7.5 High severity
https://github.com/curl/curl: Exposure of Sensitive Information to an Unauthorized Actor
An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the connection pool but with a different zone id it could reuse a connection instead.
- 8.1 High severity
https://github.com/curl/curl: Missing Authentication for Critical Functionality
An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfe
- 9.8 Critical severity
Brocade SANNav: Improper Neutralization of Special Elements used in an SQL Command
In Brocade SANnav before Brocade SANnav 2.2.0, multiple endpoints associated with Zone management are susceptible to SQL injection, allowing an attacker to run arbitrary SQL commands.
- 7.5 High severity
Tcpreplay: Missing Release of Memory after Effective Lifetime
Tcpreplay version 4.4.1 contains a memory leakage flaw in fix_ipv6_checksums() function. The highest threat from this vulnerability is to data confidentiality.