CVE-2026-87687: Input Validation
An authorization and input validation vulnerability exists in Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user with restricted privileges in one Virtual Fabric can exploit this issue by submitting a specially crafted request containing an arbitrary fabric identifier. This allows the user to perform unauthorized cross-fabric operations and view configuration details within tenants/Virtual Fabrics to which they have not been granted access.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Brocade Fabric OSto a version that resolves this vulnerability.Fixed in 9.2.2d - Upgrade
Upgrade
Brocade Fabric OSto a version that resolves this vulnerability.Fixed in 10.0.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Brocade Fabric OS deployments running versions before 9.2.2d, or versions 10.0.0 through 10.0.0a1, are affected when Virtual Fabrics are in use. The issue enables access across tenant or Virtual Fabric boundaries.
What does an attacker need to exploit it?
The attacker needs an authenticated account with restricted privileges in one Virtual Fabric. They can submit a specially crafted request containing an arbitrary fabric identifier; no user interaction is required.
What could an attacker do after exploitation?
An attacker can perform unauthorized operations in other Virtual Fabrics and view configuration details for tenants or Virtual Fabrics they were not authorized to access.
What versions should be used to remediate the issue?
Update to Brocade Fabric OS 9.2.2d or later, or move off the affected 10.0.0 through 10.0.0a1 range. The provided data identifies versions before 9.2.2d and 10.0.0 through 10.0.0a1 as affected.