CVE-2026-87659
Received Received - Intake

Authorization Bypass in Brocade Fabric OS

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: Brocade Communications Systems, LLC

Description
A critical authorization bypass vulnerability exists in the Management Server handling of Brocade Fabric OS versions before 10.0.1. A compromised switch connected to the fabric can transmit crafted inband Fibre Channel vendor-unique CT (Common Transport) management requests to bypass administrative authentication. Successful exploitation allows an unauthorized peer switch to execute administrative actions on the target device, including resetting administrative passwords, initiating system reboots, and triggering firmware downloads.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-08
Last Modified
2026-10-08
Generated
2026-10-08
AI Q&A
2026-10-08
EPSS Evaluated
N/A
NVD
CVE-2026-87659
EUVD
EUVD-2026-94668

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Brocade Fabric OS 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a critical authorization bypass vulnerability in Brocade Fabric OS versions before 10.0.1. A compromised switch connected to the fabric can send specially crafted Fibre Channel management requests to bypass authentication. This allows an unauthorized peer switch to perform administrative actions like resetting passwords, rebooting systems, or downloading firmware.

Detection Guidance

Detecting this vulnerability requires monitoring for unauthorized Fibre Channel vendor-unique CT management requests on Brocade Fabric OS switches. Check switch logs for unusual administrative actions or unexpected firmware updates. Inspect network traffic for crafted inband CT requests targeting the Management Server. Ensure Fabric OS is updated to version 10.0.1 or later to mitigate the risk.

Impact Analysis

If exploited, an attacker could gain administrative control over affected Brocade switches. This could lead to unauthorized system changes, data breaches, or service disruptions. Organizations using vulnerable Fabric OS versions face risks of unauthorized access and potential operational downtime.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations may face compliance violations, legal penalties, and reputational damage if exploited. Proper patching and access controls are critical to maintain compliance.

Mitigation Strategies

Upgrade Brocade Fabric OS to version 10.0.1 or later to address the authorization bypass vulnerability. Isolate affected switches from untrusted networks and monitor for unusual administrative actions or requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-87659. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart