CVE-2026-87665: Buffer Overflow
A stack-based buffer overflow vulnerability exists in the Internet Key Exchange (IKEv2) protocol handler on Brocade Fabric OS versions before 10.0.1. The vulnerability occurs when processing initial IKE key exchange requests on extension switches or blades running IPsec-enabled Fibre Channel over IP (FCIP) circuits. An unauthenticated remote attacker can exploit this vulnerability by sending a single, specifically crafted UDP packet (Port 500) containing an oversized Nonce payload. Successful exploitation results in a denial of service (data-plane process crash)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Brocade Fabric OSto a version that resolves this vulnerability.Fixed in 10.0.1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Exposure is limited to extension switches or blades running IPsec-enabled Fibre Channel over IP (FCIP) circuits with an affected Brocade Fabric OS version before 10.0.1. The vulnerable component processes IKEv2 initial key exchange requests.
What does an attacker need to exploit it?
An unauthenticated remote attacker needs network access to UDP port 500 on an affected system. Exploitation requires sending one specifically crafted IKE packet containing an oversized Nonce payload.
What is the expected impact of successful exploitation?
Successful exploitation crashes the data-plane process, causing a denial of service. The provided information does not describe confidentiality impact or integrity impact.
How can this be mitigated if an upgrade is not immediately possible?
Restrict network access to UDP port 500 so untrusted remote systems cannot send IKEv2 requests to affected extension switches or blades. This mitigation follows from the stated remote attack vector and required UDP port.