Brocade Fabric OS up to 9.2.2c/10.0.0a1 WebTools management interface status file path denial of service

Summaryinfo

A vulnerability categorized as very critical has been discovered in Brocade Fabric OS up to 9.2.2c/10.0.0a1. The affected element is an unknown function of the component WebTools management interface. Executing a manipulation of the argument status file path can lead to denial of service. The identification of this vulnerability is CVE-2026-87685. The attack may be launched remotely. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as very critical was found in Brocade Fabric OS up to 9.2.2c/10.0.0a1. This vulnerability affects an unknown functionality of the component WebTools management interface. The manipulation of the argument status file path with an unknown input leads to a denial of service vulnerability. The CWE definition for the vulnerability is CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

An arbitrary file manipulation vulnerability exists in the WebTools management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When processing configuration transfer requests, the application fails to properly validate and sanitize a user-supplied status file path parameter. An authenticated administrative user can exploit this issue by submitting a specially crafted status file parameter, causing the underlying process to move an arbitrary system file to a predictable, world-readable temporary directory. This can lead to persistent Denial of Service (DoS), critical system file destruction, host compromise, or sensitive data leakage.

The advisory is available at support.broadcom.com. This vulnerability was named CVE-2026-87685 since 09/09/2026. The exploitation appears to be easy. The attack can be initiated remotely. Additional levels of successful authentication are needed for exploitation. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 10/09/2026). This vulnerability is assigned to T1499 by the MITRE ATT&CK project.

Upgrading to version 9.2.2d eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-94686). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Brocade

Name

• Fabric OS

Version

• 9.2.2a
• 9.2.2b
• 9.2.2c
• 10.0.0a1

License

• commercial

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion