CVE-2026-87672: Medium severity Brocade Fabric OS vulnerability
An information disclosure vulnerability exists in the SupportLink diagnostic collection utilities of Brocade Fabric OS versions before 10.0.1. When SupportLink is configured to use an authenticated HTTP proxy, the system stores the full proxy URL. Anyone with access to the diagnostic support bundle, such as support personnel or users with access to file shares where support bundles are stored, can extract these cleartext proxy credentials.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Brocade Fabric OSto a version that resolves this vulnerability.Fixed in 10.0.1
Event History
Frequently Asked Questions
Who can obtain the exposed proxy credentials?
Anyone who can access a diagnostic support bundle can extract them. This includes support personnel and users with access to file shares where support bundles are stored.
What configuration is required for exposure?
The issue applies when SupportLink is configured to use an authenticated HTTP proxy. In that configuration, the full proxy URL, including cleartext credentials, is stored in the diagnostic support bundle.
Which versions are affected?
Brocade Fabric OS versions before 10.0.1 are affected.
What should be reviewed if patching cannot happen immediately?
Restrict access to diagnostic support bundles and the file shares used to store them, since bundle access enables credential extraction. Review existing bundles created under an authenticated HTTP proxy configuration as potentially containing cleartext proxy credentials.