CVE-2026-87669: Medium severity Brocade Fabric OS vulnerability

Q: Who can exploit this issue?

An authenticated user with low-privilege REST API access can exploit it. The user's assigned role or administrative scope does not prevent access to MAPS violation data from all logical switches.

Q: What information could be exposed?

The affected REST API endpoint can expose complete MAPS violation data across the chassis, including system health metrics, port performance violations, and configuration data.

Q: Are systems running Fabric OS 10.0.1 affected?

The issue affects Brocade Fabric OS versions before 10.0.1. Based on the available information, version 10.0.1 is not within the stated affected version range.

Q: What is the immediate mitigation if an upgrade cannot be performed?

The provided information does not specify a vendor workaround. Restrict REST API access to only trusted, necessary users and review low-privilege API accounts, since authenticated API access is required for exploitation.

Published Oct 8, 2026

Updated

A missing authorization check in Brocade Fabric OS versions before 10.0.1 REST API interface of affected platform releases allows an authenticated user, regardless of their assigned role or administrative scope, to retrieve complete Monitoring and Alerting Policy Suite (MAPS) violation data across all logical switches. An attacker with low-privilege API access can leverage this endpoint to dump chassis-wide system health metrics, port performance violations, and configuration data without appropriate privileges.

Affected Software

1 affected component

Brocade Fabric OS<10.0.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Brocade Fabric OS to a version that resolves this vulnerability.
Fixed in 10.0.1

Event History

Oct 8, 2026

CVE Published

via MITRE·02:48 AM

Data Sourced

via MITRE·02:48 AM

RemedyDescriptionWeakness

Data Sourced

via NVD·03:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated user with low-privilege REST API access can exploit it. The user's assigned role or administrative scope does not prevent access to MAPS violation data from all logical switches.

What information could be exposed?

The affected REST API endpoint can expose complete MAPS violation data across the chassis, including system health metrics, port performance violations, and configuration data.

Are systems running Fabric OS 10.0.1 affected?

The issue affects Brocade Fabric OS versions before 10.0.1. Based on the available information, version 10.0.1 is not within the stated affected version range.

What is the immediate mitigation if an upgrade cannot be performed?

The provided information does not specify a vendor workaround. Restrict REST API access to only trusted, necessary users and review low-privilege API accounts, since authenticated API access is required for exploitation.

CVE-2026-87669: Medium severity Brocade Fabric OS vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What information could be exposed?

Are systems running Fabric OS 10.0.1 affected?

What is the immediate mitigation if an upgrade cannot be performed?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What information could be exposed?

Are systems running Fabric OS 10.0.1 affected?

What is the immediate mitigation if an upgrade cannot be performed?