CVE-2026-87665 in Fabric OS
Summary
by MITRE • 10/08/2026
A stack-based buffer overflow vulnerability exists in the Internet Key Exchange (IKEv2) protocol handler on Brocade Fabric OS versions before 10.0.1. The vulnerability occurs when processing initial IKE key exchange requests on extension switches or blades running IPsec-enabled Fibre Channel over IP (FCIP) circuits. An unauthenticated remote attacker can exploit this vulnerability by sending a single, specifically crafted UDP packet (Port 500) containing an oversized Nonce payload. Successful exploitation results in a denial of service (data-plane process crash)
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/08/2026
The Internet Key Exchange version two protocol serves as the foundational mechanism for establishing security associations within IPsec tunnels, ensuring that data transmitted over insecure networks remains confidential and intact. In Brocade Fabric OS versions prior to 10.0.1, a critical implementation flaw exists within the IKEv2 handler component responsible for managing key exchange operations on extension switches or blades configured with Internet Protocol Security-enabled Fibre Channel over IP circuits. This specific subsystem is tasked with parsing incoming negotiation messages and validating their structure before proceeding with cryptographic handshake procedures. The vulnerability arises from an insufficient validation of input data length during the processing of initial IKE key exchange requests, specifically concerning the Nonce payload field which contains random numbers used to prevent replay attacks.
A stack-based buffer overflow occurs when a program writes more data to a fixed-length block of memory on the call stack than it can hold, overwriting adjacent memory locations and potentially altering control flow or crashing the application. In this context, an unauthenticated remote attacker can exploit this flaw by sending a single, specifically crafted UDP packet directed at port 500, which is the standard port for IKEv1 and IKEv2 traffic. The malicious payload contains an oversized Nonce field that exceeds the allocated buffer size defined within the firmware's processing logic. Because the software fails to perform adequate bounds checking before copying this data into the stack-allocated buffer, the excess bytes spill over into adjacent memory regions, corrupting critical control structures such as return addresses or function pointers stored on the stack.
The operational impact of successfully exploiting this vulnerability is a denial of service condition characterized by the crash of the data-plane process within the Brocade Fabric OS environment. Since the IKEv2 handler operates at a low level to manage network connectivity and security associations, its failure disrupts the underlying Fibre Channel over IP infrastructure. This disruption can lead to immediate loss of connectivity for devices relying on these extension switches or blades, effectively halting data transmission across the affected fabric segments. The crash is triggered by the memory corruption caused by the buffer overflow, which destabilizes the process execution environment and forces an abrupt termination of the service responsible for maintaining secure tunnels.
From a classification perspective, this vulnerability aligns with CWE-121, which denotes stack-based buffer overflow, indicating that the root cause lies in improper handling of input data leading to memory corruption on the call stack. Furthermore, the attack vector corresponds to ATT&CK technique T1498.001, Network Denial of Service via Direct Network Floods, as it involves sending a single crafted packet rather than high-volume traffic, yet still achieves service disruption through resource exhaustion or process failure due to software defects. The lack of authentication required for exploitation makes this particularly dangerous in environments where management interfaces or extension ports are exposed to untrusted networks without proper access controls.
Mitigation strategies primarily involve upgrading the Brocade Fabric OS firmware to version 10.0.1 or later, which includes patches that enforce strict length validation on incoming IKEv2 payloads before buffer allocation and copying operations occur. Until such an upgrade is feasible, network administrators should implement robust perimeter security measures by restricting access to UDP port 500 using firewalls or access control lists to allow only trusted IP addresses to initiate IKE negotiations. Additionally, enabling intrusion detection systems capable of identifying anomalous packet sizes in IKE traffic can provide early warning indicators for attempted exploitation attempts. Regular monitoring of system logs for unexpected process restarts or crashes is also recommended to detect potential exploitation activity and ensure rapid response capabilities are in place.