CVE-2026-87659: High severity Brocade Fabric OS vulnerability
A critical authorization bypass vulnerability exists in the Management Server handling of Brocade Fabric OS versions before 10.0.1. A compromised switch connected to the fabric can transmit crafted inband Fibre Channel vendor-unique CT (Common Transport) management requests to bypass administrative authentication. Successful exploitation allows an unauthorized peer switch to execute administrative actions on the target device, including resetting administrative passwords, initiating system reboots, and triggering firmware downloads.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Brocade Fabric OSto a version that resolves this vulnerability.Fixed in 10.0.1
Event History
Frequently Asked Questions
Which environments should be prioritized for review?
Prioritize Brocade Fabric OS Management Server deployments running versions before 10.0.1, particularly fabrics that contain switches which could be compromised and communicate with the target over inband Fibre Channel management traffic.
What access does an attacker need to exploit this issue?
The attacker needs control of a switch connected to the fabric. That compromised peer switch can send crafted vendor-unique CT management requests over the inband Fibre Channel connection; no user interaction is indicated.
What version addresses the affected-version range?
Version 10.0.1 is the first Brocade Fabric OS version not identified as affected. Systems running an earlier version should be treated as vulnerable.