CVE-2026-87687 in Fabric OS
Summary
by MITRE • 10/08/2026
An authorization and input validation vulnerability exists in Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user with restricted privileges in one Virtual Fabric can exploit this issue by submitting a specially crafted request containing an arbitrary fabric identifier. This allows the user to perform unauthorized cross-fabric operations and view configuration details within tenants/Virtual Fabrics to which they have not been granted access.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified in Brocade Fabric OS versions prior to 9.2.2d and between 10.0.0 through 10.0.0a1 represents a critical failure in the enforcement of multi-tenant isolation boundaries within Fibre Channel storage area networks. This flaw is fundamentally rooted in insufficient input validation combined with broken access control mechanisms, allowing an authenticated user to bypass intended security restrictions. In enterprise environments utilizing Virtual Fabrics or tenants, strict logical separation is required to ensure that different organizational units operate independently without interference. The vulnerability undermines this isolation by permitting a user operating within the context of one specific Virtual Fabric to manipulate system parameters associated with other distinct Virtual Fabrics through specially crafted API requests.
From a technical perspective, the core issue lies in how the application processes fabric identifiers submitted during administrative operations. When an authenticated user with restricted privileges initiates a request, the backend logic fails to adequately verify that the requested operation is authorized for the specific tenant context of the caller. Instead of strictly binding actions to the current session's assigned Virtual Fabric ID, the system accepts arbitrary fabric identifiers provided in the payload. This lack of server-side validation allows attackers to substitute their own identifier or target a different tenant's identifier, effectively tricking the management interface into executing commands outside the user's permitted scope. The flaw is particularly dangerous because it does not require privilege escalation at the operating system level; rather, it exploits logical flaws in the application layer authorization checks that govern multi-tenancy features.
The operational impact of this vulnerability is severe for organizations relying on Brocade switches for critical data infrastructure. An attacker who gains access to a low-privileged account within one Virtual Fabric can potentially view sensitive configuration details belonging to other tenants or administrators. This includes network topology maps, zoning configurations, and storage array mappings that should remain confidential. Furthermore, the ability to perform unauthorized cross-fabric operations means an adversary could disrupt service availability by modifying zoning rules or triggering administrative actions in unrelated segments of the fabric. Such disruptions can lead to significant downtime for production workloads stored on affected systems, resulting in financial loss and reputational damage. The vulnerability essentially breaks the trust model between isolated tenants, turning a security feature designed for separation into a vector for lateral movement and data exfiltration within the storage network.
This type of flaw is commonly categorized under CWE-269 Improper Privilege Escalation or more specifically CWE-862 Missing Authorization when considering the cross-fabric aspect as an authorization bypass, though it also aligns with CWE-20 Poor Input Validation due to the acceptance of arbitrary identifiers without proper sanitization. In terms of adversary tactics, this vulnerability facilitates techniques associated with MITRE ATT&CK ID T1530 Data from Cloud Storage Object or T1078 Valid Accounts if used for initial access, but more accurately maps to lateral movement and data staging within a compromised environment by exploiting trust relationships between isolated segments. It allows an attacker to pivot across logical boundaries that are supposed to be impermeable, thereby expanding the blast radius of any single account compromise.
Mitigation strategies must prioritize immediate patching as recommended by Brocade. Organizations running affected versions should upgrade to Fabric OS version 9.2.2d or later, or ensure they are not using the vulnerable range of 10.0.0 through 10.0.0a1 if those specific builds contain the fix. Until patches can be applied, administrators should enforce strict role-based access control policies, ensuring that users with limited privileges have minimal exposure to management interfaces capable of issuing cross-fabric commands. Network segmentation and monitoring for anomalous API calls involving unexpected fabric identifiers can also help detect exploitation attempts in real-time. Regular audits of user permissions and review of audit logs for unauthorized configuration changes are essential defensive measures to maintain the integrity of multi-tenant environments against this specific class of logical flaws.