CVE-2026-87659 is a critical authorization bypass in Brocade Fabric OS that lets a switch already compromised on a Fibre Channel fabric send crafted inband management requests to a peer switch and perform administrative actions on it — including resetting admin passwords, rebooting it, and pushing firmware downloads — without authenticating, making it a fabric-wide lateral-movement and persistence risk once a single switch is compromised.
Vulnerability summary
9.8
Critical
0.2%
EPSS score (FIRST)
No
CISA KEV catalog
2026-10-08
Published
Vulnerability ID: CVE-2026-87659 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Brocade Fabric OS | cpe:2.3:o:broadcom:fabric_operating_system:*:*:*:*:*:*:*:* | Before 10.0.1 (fixed in 10.0.1) |
What this means
CVE-2026-87659 (CWE-306, Missing Authentication for Critical Function) affects the Management Server component of Brocade Fabric OS, the firmware that runs Broadcom's Brocade Fibre Channel SAN switches. NVD's description states: "A critical authorization bypass vulnerability exists in the Management Server handling of Brocade Fabric OS versions before 10.0.1. A compromised switch connected to the fabric can transmit crafted inband Fibre Channel vendor-unique CT (Common Transport) management requests to bypass administrative authentication. Successful exploitation allows an unauthorized peer switch to execute administrative actions on the target device, including resetting administrative passwords, initiating system reboots, and triggering firmware downloads" (NVD).
NVD's own analysis assigns a Primary CVSS v3.1 base score of 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Broadcom's own CNA submission (sourceIdentifier [email protected]) separately scores it CVSS v4.0 7.1, vector CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H — a materially lower score because the v4.0 submission models the attack as local (AV:L, over the inband fabric link) and requiring high privileges (PR:H, i.e. already being a switch on the fabric), while NVD's own Primary v3.1 analysis treats it as network-reachable with no privileges required. The GitHub Advisory Database mirrors the NVD framing at "high" severity with the same 9.8 CVSS v3.1 score and CWE-306 classification (GitHub Advisory Database GHSA-6h29-8pxc-j4qg).
The affected range is Fabric OS versions before 10.0.1, with the fix shipped in 10.0.1; NVD's CPE match data pins the vulnerable range to the same cutoff (NVD). Broadcom's own advisory page (SecurityAdvisories/0/39153) is gated behind a Broadcom support login/bot-check wall and could not be fetched directly for this advisory; the technical description, scoring, and affected-version data above come from NVD's own analysis and the GitHub Advisory Database mirror, not from a WebFetch summary of the gated page.
As of 2026-10-30, FIRST scores the probability of exploitation at 0.00241 (15.1th percentile) (FIRST EPSS). CVE-2026-87659 is not currently listed in the CISA Known Exploited Vulnerabilities catalog (checked against the live KEV feed, catalog version 2026.10.30, 1766 entries).
Because Fibre Channel SAN fabrics are typically treated as a trusted internal zone with switch-to-switch management traffic left unauthenticated by design, a single compromised switch — whether via a separate vulnerability, a supply-chain issue, or physical access — can use this flaw to pivot and take administrative control of every other switch on the fabric. Fabric OS deployments should upgrade to 10.0.1 or later and should not assume that fabric-internal traffic is implicitly trustworthy.
Evidence
- A compromised switch connected to the fabric can send crafted inband Fibre Channel vendor-unique CT management requests to bypass administrative authentication on a peer switch, allowing password resets, reboots, and firmware downloads (CWE-306). — NVD
- NVD Primary CVSS v3.1 base score is 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); Broadcom's own CNA CVSS v4.0 submission scores it 7.1 (CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/...), modeling the attack as local/fabric-internal with high privileges rather than network/no-privilege. — NVD
- Affected: Brocade Fabric OS before 10.0.1, fixed in 10.0.1. Mirrored in the GitHub Advisory Database at CVSS v3.1 9.8, severity "high", CWE-306. — GitHub Advisory Database
- EPSS score is 0.00241 (15.1th percentile) as of 2026-10-30; not present in the live CISA KEV feed (catalog version 2026.10.30, 1766 entries) checked by exact cveID match. — FIRST EPSS
