CVE-2026-87669 in Fabric OS
Summary
by MITRE • 10/08/2026
A missing authorization check in Brocade Fabric OS versions before 10.0.1 REST API interface of affected platform releases allows an authenticated user, regardless of their assigned role or administrative scope, to retrieve complete Monitoring and Alerting Policy Suite (MAPS) violation data across all logical switches. An attacker with low-privilege API access can leverage this endpoint to dump chassis-wide system health metrics, port performance violations, and configuration data without appropriate privileges.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified in Brocade Fabric OS versions prior to 10.0.1 represents a critical failure in the implementation of authorization controls within the platform's Representational State Transfer application programming interface. This flaw specifically affects the endpoint responsible for retrieving Monitoring and Alerting Policy Suite violation data, allowing any authenticated user to access sensitive information regardless of their assigned role or administrative scope. In enterprise storage area network environments, proper segregation of duties is essential to maintain operational integrity and security posture. The absence of a robust authorization check at this specific interface point means that the system fails to validate whether the requesting entity possesses the necessary privileges to view chassis-wide metrics, effectively bypassing intended access restrictions designed to limit data exposure based on user hierarchy.
From a technical perspective, the core issue lies in the lack of role-based access control enforcement for sensitive API endpoints. While authentication mechanisms successfully verify that a user is logged into the system, the authorization layer fails to cross-reference this identity against specific permissions required to query Monitoring and Alerting Policy Suite data. This oversight allows low-privilege accounts, which typically have limited visibility into core infrastructure health and configuration details, to execute queries that return comprehensive violation logs across all logical switches within a fabric. The attacker can leverage these endpoints to dump chassis-wide system health metrics, port performance violations, and underlying configuration data without triggering additional security alerts or requiring elevated credentials.
The operational impact of this vulnerability is significant for organizations relying on Brocade Fabric OS for critical storage infrastructure management. An adversary with low-privilege API access can exploit this flaw to conduct reconnaissance activities that reveal the internal state of the network fabric. By retrieving complete violation data, an attacker gains insight into port performance issues, potential misconfigurations, and system health anomalies that are typically reserved for senior administrators or security operations centers. This information disclosure facilitates further attacks by providing a detailed map of the infrastructure's weaknesses and operational status, potentially aiding in more sophisticated intrusions such as denial-of-service planning or targeted exploitation of known configuration flaws identified through this data dump.
This vulnerability aligns with Common Weakness Enumeration category CWE-285, which describes Improper Authorization, where an application does not properly restrict access to resources for unauthorized actors. Furthermore, the ability to enumerate system health metrics and port performance violations maps directly to ATT&CK technique T1087, specifically Account Discovery and System Information Discovery within the Enterprise matrix. These techniques involve gathering information about accounts on a local network or domain as well as collecting details about the operating system and hardware installed on connected systems. The exploitation of this API endpoint allows an attacker to move from initial access to deeper reconnaissance without escalating privileges through traditional means, thereby increasing the risk of lateral movement within the storage fabric.
To mitigate this vulnerability, organizations must immediately apply the vendor-recommended firmware updates that address version 10.0.1 or later, which include corrected authorization logic for the affected REST API endpoints. Until patches are applied, administrators should restrict network access to the management interfaces of Brocade switches using strict firewall rules and virtual local area network segmentation to limit exposure to only trusted administrative subnets. Additionally, implementing robust monitoring solutions that detect unusual patterns in API usage, such as frequent requests from low-privilege accounts for sensitive violation data, can help identify potential exploitation attempts in real time. Regular audits of user roles and permissions should also be conducted to ensure that the principle of least privilege is strictly enforced across all management interfaces.