EXPOSURES › CVE-2026-87659
CVE-2026-87659
CRITICALA critical authorization bypass in Brocade Fabric OS before 10.0.1 lets compromised switches bypass admin authentication and execute actions like password resets and reboots.
An unauthorized switch can send crafted CT management requests to bypass authentication, allowing password resets, reboots, and firmware downloads. DIB orgs must patch Fabric OS to 10.0.1+ and monitor fabric integrity to prevent lateral movement and administrative compromise.
Shame score — A critical authorization bypass in a widely deployed storage fabric OS that allows password resets and reboots without requiring a zero-day exploit or ransomware link.
▸ RECOMMENDED ACTION Remote code execution — patch the affected products on priority.
A critical authorization bypass vulnerability exists in the Management Server handling of Brocade Fabric OS versions before 10.0.1. A compromised switch connected to the fabric can transmit crafted inband Fibre Channel vendor-unique CT (Common Transport) management requests to bypass administrative authentication. Successful exploitation allows an unauthorized peer switch to execute administrative actions on the target device, including resetting administrative passwords, initiating system reboots, and triggering firmware downloads.
| PRODUCT | STATUS |
|---|---|
| Clarity Broadcom |
Authorized |
| General Support Systems (GSS) Broadcom |
Authorized |
| Rally Broadcom |
Authorized |
| Symantec Gov Cloud Security (GCS) Broadcom |
In Process |