CVE-2026-87672 in Fabric OS
Summary
by MITRE • 10/08/2026
An information disclosure vulnerability exists in the SupportLink diagnostic collection utilities of Brocade Fabric OS versions before 10.0.1. When SupportLink is configured to use an authenticated HTTP proxy, the system stores the full proxy URL. Anyone with access to the diagnostic support bundle, such as support personnel or users with access to file shares where support bundles are stored, can extract these cleartext proxy credentials.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified in Brocade Fabric OS versions prior to 10.0.1 represents a significant information disclosure risk within the SupportLink diagnostic collection utilities. This flaw specifically manifests when the system is configured to utilize an authenticated HTTP proxy for network communications. In this configuration, the operating system fails to adequately protect sensitive authentication data during its storage phase. Instead of employing cryptographic hashing or secure encryption mechanisms to safeguard credentials, the software stores the full proxy URL in plaintext within local diagnostic files. This architectural oversight means that any secret required to authenticate with the proxy server is persisted on disk without obfuscation, creating a direct pathway for unauthorized actors to retrieve these sensitive values if they gain access to the underlying file system or diagnostic outputs generated by the system.
The operational impact of this vulnerability centers on the exposure of network authentication credentials and potentially broader organizational security posture. The primary risk involves individuals who have legitimate but limited access to support bundles, such as technical support personnel from Brocade or third-party administrators managing storage area networks. If these users extract the diagnostic support bundle, they can easily parse the stored files to recover cleartext proxy usernames and passwords. Beyond immediate credential theft, this exposure facilitates lateral movement within a network environment where that same proxy authentication is reused for other services. Attackers who compromise a host with access to these bundles could leverage the stolen credentials to bypass perimeter security controls, intercept traffic intended for external destinations, or impersonate legitimate users in subsequent attacks against downstream systems protected by the compromised proxy infrastructure.
From a classification perspective, this vulnerability aligns closely with CWE-312, which defines Cleartext Storage of Sensitive Information. The failure to encrypt or hash sensitive data before storage is a fundamental deviation from secure coding practices mandated by industry standards such as OWASP Application Security Verification Standard and NIST SP 800-57 regarding key management and credential protection. Furthermore, the exploitation vector relates to ATT&CK technique T1530, Data from Local System, where adversaries harvest data directly from compromised endpoints or storage systems. The specific method of extracting credentials via diagnostic bundles also touches upon aspects of T1005, Data from Local System, highlighting how administrative tools intended for troubleshooting can inadvertently become vectors for credential harvesting if security controls are not rigorously applied to the output files they generate.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. The primary corrective action is to upgrade Brocade Fabric OS to version 10.0.1 or later, where this specific flaw in the SupportLink utility has been addressed by implementing proper credential protection mechanisms. For environments unable to immediately patch due to operational constraints, administrators should review proxy configurations to ensure that credentials are not stored persistently if possible, utilizing environment variables or secure vaults for runtime authentication instead of file-based storage. Additionally, access controls on directories containing diagnostic support bundles must be strictly enforced using least privilege principles, ensuring that only essential personnel can read these files and that the files themselves are encrypted at rest where feasible. Regular audits of stored credentials across all network infrastructure components should also be conducted to identify similar misconfigurations in other systems within the data center fabric.