CVE-2026-87659 is a critical (CVSS 9.8) authorization bypass in the management server of Brocade Fabric OS before 10.0.1. A compromised switch in the fabric can send crafted management requests and perform administrative actions on a peer. Upgrade to Fabric OS 10.0.1 or later, per the Broadcom advisory.
What's affected
The record lists Brocade Fabric OS versions before 10.0.1 from Broadcom. The Broadcom advisory is the authority on which hardware and release trains are affected, and it could not be loaded when this guide was written, so read it for details such as backported fixes on older release lines.
The record describes the attacker as a compromised switch connected to the fabric, sending vendor-specific management requests over Fibre Channel. Fully compromised peers are rare, but a storage fabric holds sensitive data, so the impact is large.
How to check if you're exposed
Log in to each switch and read the firmware version:
firmwareshow
Compare the output with the fixed version in the advisory. List every switch in each fabric, not only the core ones, since the record describes an attack from one switch to another.
Also review how switches are connected and who can plug in a new one. Inter-switch links to third parties or lab equipment widen the risk.
What to do now
- List every Brocade switch and its Fabric OS version.
- Plan the upgrade to 10.0.1 or later, or to the fixed release in the advisory for your line.
- Restrict physical and administrative access to the switches and to the management network.
- Review audit logs for unexpected password resets, reboots or firmware downloads, which are the actions the record names.
- Check that firmware images come only from the vendor portal.
Why it matters
The weakness is CWE-306 (missing authentication for a critical function). Management requests from a peer switch were accepted without the authentication that administrators face, so an attacker who controls one switch could reset administrative passwords, restart a device, or trigger a firmware download on another.
Storage networks are often treated as trusted, and trust between peers is exactly what this flaw abuses. Segmenting management access and watching for unexpected changes limits the damage when one device falls.
The record does not mark this CVE as known exploited, and it is not in the CISA KEV list.
Quick check
Which version fixes it?
Fabric OS 10.0.1, according to the record. Confirm the fixed release for your hardware in the Broadcom advisory.
If you want a quick look at your own dependencies, the free in-browser scan at gold.safeguard.sh/scan needs no repository access.
Sources
Listed in the record but not readable when this guide was written, so confirm details there:
Last reviewed: 19 October 2026.
