Paper/Archive/CVE-2026-87659

CVE-2026-87659

Brocade Fabric OS — A critical authorization bypass vulnerability exists in the Management Server handling of Brocade Fabric OS versions before 10.0.1.

EPSS 0.2%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 15.2.152 × 203.0 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A critical authorization bypass vulnerability exists in the Management Server handling of Brocade Fabric OS versions before 10.0.1. A compromised switch connected to the fabric can transmit crafted inband Fibre Channel vendor-unique CT (Common Transport) management requests to bypass administrative authentication. Successful exploitation allows an unauthorized peer switch to execute administrative actions on the target device, including resetting administrative passwords, initiating system reboots, and triggering firmware downloads.

Affected

ProductAffectedFixed inSource

Fabric OS< 10.0.110.0.1CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

brocade (CNA)7.1CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refsupport.broadcom.com/external/content/SecurityAdvisories/0/39153