High severity · published Oct 8, 2026
CVE-2026-87687
An authorization and input validation vulnerability exists in Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1
7.3
CVSS
0.2%
EPSS
No
On KEV
Description
An authorization and input validation vulnerability exists in Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user with restricted privileges in one Virtual Fabric can exploit this issue by submitting a specially crafted request containing an arbitrary fabric identifier. This allows the user to perform unauthorized cross-fabric operations and view configuration details within tenants/Virtual Fabrics to which they have not been granted access.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Adjacent
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FO
Fabric OS · Brocade
before 9.2.2d; 10.0.0 through 10.0.0a1 · source: vendor
FO
Fabric Operating System · Broadcom
before 9.2.2d; 10.0.0 before 10.0.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-87687
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-87687
support.broadcom.com
https://support.broadcom.com/external/content/SecurityAdvisories/0/39081
More from Fabric OS
6.7
CVE-2025-1976
Code injection exposure in Fabric OS 9.1.0 through 9.1.1d6
9.8
CVE-2026-87659
A critical authorization bypass vulnerability exists in the Management Server handling of Brocade Fabric OS versions before 10.0.1
9.8
CVE-2026-87684
A stack-based buffer overflow vulnerability exists in the SNMP daemon request handling of Brocade Fabric versions before 10.0.1
8.8
CVE-2026-94585
An authentication bypass vulnerability exists in the web management interface of Brocade Fabric OS versions before 9.2.2d running on the MXG610 platform
8.8
CVE-2026-94578
Brocade Fabric OS versions before 10.0.1 contain an authorization logic vulnerability in the AAA (Authentication, Authorization, and Accounting) integration framework allows…