CVE-2026-87679 in Fabric OS
Summary
by MITRE • 10/08/2026
When Brocade Fabric OS versions before 10.0.1 processes trunk configuration operations, the application parses user-supplied list strings into dynamically allocated heap arrays without enforcing boundary checks on the maximum allowable number of elements. An authenticated administrator can exploit this vulnerability via crafted REST API requests containing an excessive number of list delimiters, causing heap corruption that can result in service crash or arbitrary code execution.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified involves a critical memory management flaw within Brocade Fabric OS versions prior to 10.0.1, specifically affecting the handling of trunk configuration operations through its REST API interface. The core technical issue stems from an improper boundary check during the parsing process where user-supplied list strings are converted into dynamically allocated heap arrays. When the application receives a request containing a list with delimiters indicating numerous elements, it allocates memory based on the count provided by the input without verifying if this number exceeds predefined system limits or available resources. This lack of validation allows an attacker to trigger excessive memory allocation requests that can corrupt adjacent memory structures in the heap space.
From a classification perspective, this flaw aligns with CWE-120 Buffer Overflow and CWE-789 Uncontrolled Memory Allocation, as the application fails to restrict the size of data structures derived from external input. The vulnerability is further contextualized by MITRE ATT&CK technique T1190 Exploit Public-Facing Application, given that the attack vector utilizes a web-based API interface accessible to authenticated users. While the requirement for authentication limits the scope compared to unauthenticated remote code execution vulnerabilities, it remains severe because network administrators often possess high-level privileges necessary to modify critical fabric configurations.
The operational impact of this vulnerability is significant due to its potential for both denial of service and arbitrary code execution. If an attacker sends a crafted REST API request with an excessive number of list delimiters, the resulting heap corruption can destabilize the application process hosting the management interface. This instability typically manifests as a service crash or restart, leading to a temporary loss of fabric management capabilities which disrupts network operations. More critically, sophisticated exploitation techniques could leverage the memory corruption to overwrite function pointers or return addresses on the stack, thereby achieving arbitrary code execution with the privileges of the affected process. In enterprise environments where Fabric OS manages critical storage area networks, such disruptions can lead to data unavailability and significant operational downtime.
Mitigation strategies primarily involve upgrading Brocade Fabric OS to version 10.0.1 or later, which includes patches for this specific memory handling defect. Until an upgrade is feasible, administrators should implement strict access controls on the REST API endpoints, ensuring that only trusted management stations can interact with trunk configuration functions. Additionally, deploying web application firewalls configured to detect and block requests containing abnormally large lists or excessive delimiters in payload data can provide a layer of defense against exploitation attempts. Regular monitoring of system logs for unusual spikes in memory usage or service restarts associated with the REST API can also aid in early detection of potential exploitation activities.