CVE-2026-87681
Received Received - Intake

Access Control Bypass in Brocade Fabric OS

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: Brocade Communications Systems, LLC

Description
An Access Control Bypass vulnerability exists in the Role-Based Access Control (RBAC) validation engine of Brocade Fabric OS versions before 10.0.1. When processing certain management protocol operations, the RBAC engine incorrectly categorizes non-standard action opcodes during permission checks. This allows authenticated users with read-only management privileges to bypass access controls and execute restricted administrative operations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-08
Last Modified
2026-10-08
Generated
2026-10-08
AI Q&A
2026-10-08
EPSS Evaluated
N/A
NVD
CVE-2026-87681
EUVD
EUVD-2026-94655

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Brocade Fabric OS 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an Access Control Bypass vulnerability in Brocade Fabric OS versions before 10.0.1. The RBAC validation engine incorrectly processes non-standard action opcodes during permission checks. This allows authenticated users with read-only privileges to bypass access controls and execute administrative operations they should not be able to perform.

Detection Guidance

This vulnerability can be detected by reviewing Brocade Fabric OS versions before 10.0.1 for RBAC misconfigurations. Check system logs for unauthorized administrative operations performed by read-only users. Verify permission assignments in the RBAC engine configuration.

Impact Analysis

An attacker with read-only access could escalate privileges to perform unauthorized administrative actions. This could lead to data breaches, system misconfigurations, or unauthorized changes to critical infrastructure. The impact depends on the specific operations performed after bypassing controls.

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict access controls and audit logging for administrative actions. Organizations using affected Brocade Fabric OS versions may fail audits for GDPR, HIPAA, or other regulations due to insufficient access restrictions and potential unauthorized administrative access.

Mitigation Strategies

Immediately upgrade Brocade Fabric OS to version 10.0.1 or later to address the RBAC bypass vulnerability. Ensure all management protocol operations are reviewed for non-standard action opcodes that may exploit this issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-87681. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart