CVE-2026-87684

Executive Summary

CVE-2026-87684 is a stack-based buffer overflow (CWE-121) in the SNMP daemon request handling component of Brocade Fabric versions prior to 10.0.1. The flaw is reachable by a remote, unauthenticated attacker under default configuration via a specially crafted SNMPv3 packet whose user-supplied context name field is copied into a fixed-size stack buffer without length validation. Successful exploitation results in memory corruption, daemon crash (Denial of Service), or potential arbitrary code execution. EPSS is low (0.00229, ~12.6th percentile) and no public PoC, exploit code, or Nuclei template is known at time of writing; the vulnerability is not listed in CISA KEV.

Technical Analysis

The vulnerability resides in the SNMP daemon's request handling path, specifically within an internal statistics-gathering handler that processes incoming SNMPv3 packets. SNMPv3 (RFC 3411–3418) introduces a context name field (contextName) carried in the scoped PDU as an octet string with no protocol-imposed maximum length. The handler in question copies this attacker-controlled context name data into a fixed-size stack buffer using an unbounded copy operation (the classic precondition for CWE-121), without validating the string length against the destination buffer's capacity.

The attack surface is the SNMP service itself. Access requires network reachability to the SNMP daemon's UDP transport (conventionally UDP/161 for queries and UDP/162 for traps, though the supplied NVD description does not enumerate specific ports). The description explicitly states the attacker is "remote, unauthenticated ... under default configuration," indicating that the vulnerable code path is reachable without valid SNMPv3 user credentials — a significant exposure characteristic, since SNMPv3 is nominally an authenticated protocol. This may stem from the statistics handler being invoked during early packet processing, prior to completion of the user-based security model (USM) authentication/verification stages, a common architectural weakness class for pre-auth SNMP defects.

The defect class is a straightforward stack buffer overflow: an overlong context name overwrites adjacent stack memory, corrupting saved registers and/or the return address. Consequences described by NVD span:

• Memory corruption (undefined behavior, potential state corruption in the daemon),
• Daemon crash — a reliable Denial of Service against SNMP monitoring/management,
• Potential arbitrary code execution — dependent on platform mitigations (stack canaries, ASLR, NX/DEP, compiler hardening flags) and on the attacker's ability to shape and place a payload.

No function names, symbols, file paths, or exact buffer sizes are disclosed in the supplied NVD description; the above is an analysis at the vulnerability-class level and no implementation-specific identifiers are asserted. The affected product is Brocade Fabric (Brocade Fabric OS / FOS) prior to 10.0.1; exact affected version enumeration was not provided.

Exploitation Scenarios

No public PoC or exploit code is available; the attack chain below is inferred strictly from the vulnerability class and the NVD description. No specific code patterns, function names, or hypothetical symbols are asserted.

1. Reconnaissance / Target Identification

   • Identify internet- or management-network-exposed Brocade Fabric devices running SNMP. Discovery via Shodan/Censys queries on SNMP services (UDP/161/162) and device fingerprinting, or via internal network sweeps of SAN/FC management VLANs.
   • Determine firmware version where possible (management interfaces, banners, or fingerprinting of the fabric OS) to identify hosts below 10.0.1.

2. Triggering the Flaw

   • The attacker crafts an SNMPv3 packet containing a context name (contextName) field whose length exceeds the fixed-size stack buffer used by the statistics-gathering handler.
   • The packet is sent to the SNMP daemon. Per the NVD description, the handler is reached during processing of the incoming SNMPv3 packet and performs an unbounded copy of the context name into the fixed-size buffer.
   • The precondition of "remote, unauthenticated ... under default configuration" means no valid SNMPv3 USM credentials are required to reach the vulnerable handler.

3. Payload / Execution Method

   • At the vulnerability-class level: the oversized context name functions as the overflow payload, overwriting adjacent stack memory. If the attacker can influence the overflow content precisely, control of the saved return address (or other control data on the stack) may be achievable. Where that is not achievable, the overflow still produces memory corruption and/or a crash (DoS).
   • The exact byte layout, alignment, and required overflow length are not disclosed and must be determined empirically by a researcher; no public exploit exists.

4. Post-Exploitation Impact

   • DoS: SNMP daemon crash, halting monitoring/management telemetry for the fabric — potentially masking concurrent attacks.
   • Potential RCE: depending on platform exploit mitigations, arbitrary code execution within the SNMP daemon's privilege context, enabling further lateral movement within the SAN/fabric management plane.
   • Memory corruption short of full control may yield inconsistent daemon behavior, providing a foothold for further fault-injection attempts.

Impact Assessment

• Confidentiality: Low (per vector) — context name handling may leak or corrupt state, but no direct data exfiltration is described.
• Integrity: Low — memory corruption can alter daemon state.
• Availability: High — daemon crash is a reliable, documented outcome, directly disrupting SNMP-based monitoring and management of the Brocade fabric.
• Attack Vector: Network (AV:N); Attack Complexity: Low (AC:L) — the description frames a single crafted packet as sufficient; Privileges Required: None (PR:N) — "remote, unauthenticated ... under default configuration"; User Interaction: None (UI:N); Scope: Unchanged (S:U).
• Affected systems: Brocade Fabric (FOS) deployments below 10.0.1. Blast radius in typical enterprise environments spans SAN fabrics: SNMP monitoring/telemetry loss across monitored switches, and — in RCE scenarios — compromise of management-plane devices that control storage fabric topology.
• No CISA KEV listing and low EPSS (0.00229, ~12.6th percentile) indicate no observed exploitation in the wild at time of writing; however, pre-auth reachability elevates the risk profile for internet- or management-accessible SNMP endpoints.

Note: CVSS score is N/A in the supplied intelligence; the vector above reflects the described characteristics and should be treated as provisional pending an authoritative scoring.

Detection Guidance

Sigma Rule

title: Brocade Fabric SNMPv3 Context Name Stack Buffer Overflow Attempt (CVE-2026-87684)
id: 8f7c2e1a-4b3d-4f0a-9c6e-2d1a5b7e9c30
status: experimental
description: Detects SNMP daemon crashes/restarts correlated with oversized SNMPv3 context name fields consistent with CVE-2026-87684.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87684
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1190
  - cve.2026-87684
logsource:
  product: linux
  service: syslog
detection:
  selection_crash:
    - "snmpd"
    - "SNMP daemon"
  selection_keywords:
    - "segfault"
    - "signal 11"
    - "buffer overflow"
    - "contextName"
  condition: selection_crash and selection_keywords
falsepositives:
  - Legitimate snmpd restarts during upgrades
level: high

YARA Rule

rule CVE_2026_87684_Brocade_SNMPv3_Context_Overflow
{
    meta:
        description = "Detects SNMPv3 packet captures or binaries containing oversized contextName indicative of CVE-2026-87684 exploitation attempts"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87684"
        date = "2026-01-01"
        cve = "CVE-2026-87684"

    strings:
        $snmp3 = { 30 2e }          // SNMPv3 version marker (0x3, little variation) placeholder
        $ctx     = "contextName" ascii wide
        $magic   = { 04 }            // OCTET STRING tag preceding context name (approx.)

    condition:
        uint16(0) == 0x0000 or
        ($ctx and filesize < 10MB and #ctx > 0)
}

Suricata IDS Rule

alert udp $HOME_NET any -> $HOME_NET 161 (msg:"CVE-2026-87684 Brocade Fabric SNMPv3 context name stack buffer overflow attempt"; content:"|04|"; depth:0; byte_test:1,>,255,0,relative; flow:stateless; threshold: type both, track by_src, count 5, seconds 60; classtype:attempted-dos; reference:cve,2026-87684; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-87684; sid:5000010; rev:1;)

Elastic Detection

sequence by host.id with maxspan=2m
  [network where destination.port == 161 and network.transport == "udp" and event.action == "network_flow"]
  [process where process.name == "snmpd" and event.action == "crashed"]

Splunk SPL Query

index=network OR index=firewall sourcetype=snmp OR sourcetype=asa
| search (dest_port=161 OR dest_port=162)
| rex field=_raw max_match=1 "(?<snmp_version>v3)"
| where snmp_version="v3"
| stats count as pkt_count, dc(src_ip) as unique_sources by dest_ip, src_ip
| where pkt_count > 100
| sort - pkt_count

Correlate with OS logs:

index=os sourcetype=syslog "snmpd" ("segfault" OR "signal 11" OR "buffer overflow")
| stats count by host, _time

Wazuh OSSEC Rule

<group name="snmp,cve-2026-87684,">
  <rule id="100250" level="12">
    <decoded_as>syslog</decoded_as>
    <match>snmpd</match>
    <regex>segfault|signal 11|buffer overflow|contextName</regex>
    <description>CVE-2026-87684: Brocade Fabric SNMP daemon crash or buffer overflow indicator</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,availability,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED; no patch evidence from any tracked source.

1. Immediate mitigations (compensating controls):

   • Restrict SNMP access to SNMP daemons on Brocade Fabric devices using ACLs, firewall rules, and management-VLAN segmentation. Block UDP/161 and UDP/162 from untrusted networks; SNMP should never be internet-exposed.
   • Disable SNMPv3 where not operationally required. If required, enforce access restrictions to trusted management hosts only.
   • Enable SNMPv3 with authentication/encryption where suppression of the vulnerable path is not possible — though NVD states the flaw is reachable unauthenticated under default configuration, so credential enforcement alone may not fully mitigate.
   • Monitor SNMP daemon health; alert on unexpected snmpd restarts/segfaults as potential exploitation attempts.

2. Patch / upgrade steps:

   • Upgrade Brocade Fabric to version 10.0.1 or later per the NVD description ("versions before 10.0.1" are affected).
   • Consult the vendor's official security advisory for the precise fixed release and any interim hotfixes; no vendor reference ID was supplied in the provided data.
   • Since patch confidence is 0/4, treat any upgrade as unverified against this CVE until confirmed by the vendor advisory.

3. Long-term hardening:

   • Adopt network segmentation for SAN/fabric management planes with strict egress/ingress filtering.
   • Enable stack protection features (stack canaries, ASLR, NX/DEP) where compilers/runtimes permit, to reduce RCE feasibility for CWE-121 class defects.
   • Maintain an inventory and version-tracking process for Brocade Fabric OS to accelerate response to future advisories.
   • Use authenticated, encrypted management protocols (SNMPv3 with authPriv, SSH) and disable legacy SNMPv1/v2c.

References

1. NVD — CVE-2026-87684: https://nvd.nist.gov/vuln/detail/CVE-2026-87684
2. CWE-121 — Stack-based Buffer Overflow: https://cwe.mitre.org/data/definitions/121.html
3. Brocade / Broadcom Security Advisories (vendor advisory portal): https://www.broadcom.com/support/fibre-channel-networking/security-advisories
4. CISA Known Exploited Vulnerabilities Catalog (not listed at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
5. FIRST EPSS — CVE-2026-87684 score lookup: https://api.first.org/data/v1/epss?cve=CVE-2026-87684
6. RFC 3411–3418 — SNMPv3 framework and context name handling: https://www.rfc-editor.org/rfc/rfc3411

Threat actor note: No public exploit, PoC, Nuclei template, or in-the-wild campaign has been observed or attributed to CVE-2026-87684 at time of writing. EPSS is low (0.00229) and the CVE is not listed in CISA KEV; monitoring of vendor and CISA channels is advised.