[ CVE-2026-87659 · Published 8 Oct 2026 ]

Vulnerability in Brocade Fabric OS

CVSS 9.8 EPSS <1%2 agency advisoriesNo fix listed yet

[ Why it matters ]Priority signals

Critical severity: CVSS 9.8

[ Description ]Official description

A critical authorization bypass vulnerability exists in the Management Server handling of Brocade Fabric OS versions before 10.0.1. A compromised switch connected to the fabric can transmit crafted inband Fibre Channel vendor-unique CT (Common Transport) management requests to bypass administrative authentication. Successful exploitation allows an unauthorized peer switch to execute administrative actions on the target device, including resetting administrative passwords, initiating system reboots, and triggering firmware downloads.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

NCSC-NL16 Oct 2026NCSC-2026-0432

Vulnerabilities fixed in HPE Brocade Fabric OS Translated from Dutch
Probability/damage M/HCVE-2026-87659CVE-2026-87660CVE-2026-87661+31 more CVEs
BSI CERT-Bund7 Oct 2026WID-SEC-2026-3817

Broadcom Fabric OS: Multiple vulnerabilities Translated from German
CVE-2026-94580CVE-2026-94575CVE-2026-87673+31 more CVEs

[ References ]References

support.broadcom.com/external/content/SecurityAdvisories/0/39153Vendor Advisory