CVE-2026-87679: High severity Brocade Fabric OS vulnerability
When Brocade Fabric OS versions before 10.0.1 processes trunk configuration operations, the application parses user-supplied list strings into dynamically allocated heap arrays without enforcing boundary checks on the maximum allowable number of elements. An authenticated administrator can exploit this vulnerability via crafted REST API requests containing an excessive number of list delimiters, causing heap corruption that can result in service crash or arbitrary code execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Brocade Fabric OSto a version that resolves this vulnerability.Fixed in 10.0.1
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An authenticated administrator is required. Exploitation is performed through crafted REST API requests during trunk configuration operations.
Are default deployments affected?
The available information identifies Brocade Fabric OS versions before 10.0.1 as affected, but does not state whether trunk configuration REST API access is enabled or exposed by default.
What can an attacker achieve?
A successful exploit can corrupt heap memory, potentially causing a service crash or allowing arbitrary code execution.
What should be prioritized for remediation?
Upgrade affected Brocade Fabric OS installations to version 10.0.1 or later. Until upgrading, restrict administrator access and limit access to the REST API where operationally possible.