CVE-2026-87660 is a high severity improper permissions flaw in the diagnostic kernel module of Brocade Fabric OS before 9.2.2d, and 10.0.0 through 10.0.0a1. An unprivileged local user can run privileged hardware tests, force errors, reset blades or disrupt the storage fabric. Check the Broadcom advisory for fixed releases.
What's affected
Affected, per the record: Brocade Fabric OS versions before 9.2.2d, and 10.0.0 through 10.0.0a1. The record implies 9.2.2d is the fixed release on the 9.2 line, and does not name a fixed 10.x release. Broadcom publishes the advisory behind a browser check that my automated fetch could not pass, so the vendor page itself was not read. The details below come from the record, which cites it. Read the advisory for the full affected list, fixed versions and any workaround before acting.
The record scores it CVSS 3.1 7.1 (High). I had no second score. The record does not mark exploitation and the CVE is not in CISA KEV. Note a difference inside the batch: the record for the related CVE-2026-87664 lists 9.2.2d as affected, while this record treats 9.2.2d as the boundary. Confirm both against the advisories.
How to check if you're exposed
On a Brocade Fabric OS switch, show the running firmware from the command line:
firmwareshow
Compare the reported version with the ranges above. Do this on every switch and director in the fabric, including those in test and disaster recovery environments, since a single version table is easy to get wrong when switches were upgraded at different times.
Because this flaw needs local access, also review who holds accounts on the switches, including shared and vendor accounts, and who can reach the management network.
What to do now
- Read the Broadcom security advisory and confirm the fixed version for your product and platform.
- Inventory every affected instance, including copies in lab, test and disaster recovery sites.
- Schedule the upgrade, with a rollback plan, since these systems sit in storage network management.
- Limit management network access to administrators and jump hosts while you wait.
- Record versions in your asset inventory and subscribe to Broadcom security advisories for the product.
Why it matters
The weakness is incorrect permission assignment for a critical resource (CWE-732). A kernel module exposes diagnostic functions, such as hardware tests and the ability to force error conditions, and the access permissions on it let an unprivileged local user call them.
The impact is on availability of the storage fabric. Resetting a blade or provoking error states on a Fibre Channel director can interrupt storage paths for many hosts at once, so an unprivileged account on a switch can do more harm than its role suggests.
The precondition is local access, so the practical defence has three parts: patch, keep the number of accounts on switches small, and keep the management network separate from user networks. Storage fabrics rarely get patched often, which makes this a good time to set a recurring review.
Quick check
Does the attacker need to be an administrator?
No. The record says an unprivileged local user can invoke the diagnostic functions.
What is the fixed version?
The record treats 9.2.2d as the fixed boundary on the 9.2 line. For 10.x, read the Broadcom advisory.
Sources
- Broadcom security advisory 39155 (cited by the record; not readable by my automated fetch)
- Safeguard Gold entry for CVE-2026-87660
Last reviewed: 18 October 2026.
