CVE-2026-87664 is a high severity session context forgery in the web management daemon of Brocade Fabric OS. Local inter-process communication callbacks accept session structures, including administrative roles, without verifying the sender, so an attacker can gain admin privileges on the web interface. Check the Broadcom advisory for fixed versions.
What's affected
Affected, per the record: Brocade Fabric OS 9.2.2d and 10.0.0 through 10.0.0a1. Broadcom publishes the advisory behind a browser check that my automated fetch could not pass, so the vendor page itself was not read. The details below come from the record, which cites it. Read the advisory for the full affected list, fixed versions and any workaround before acting.
There is a source conflict to know about. The record for CVE-2026-87660, which affects the same product, lists versions before 9.2.2d as affected and treats 9.2.2d as the boundary. This record names 9.2.2d itself as affected. I could not resolve the difference without the advisory pages, so treat 9.2.2d as potentially affected until Broadcom's advisory 39164 says otherwise, and do not assume that upgrading to 9.2.2d fixes this CVE.
The record scores it CVSS 3.1 7.8 (High). I had no second score. The record does not mark exploitation and the CVE is not in CISA KEV.
How to check if you're exposed
On a Brocade Fabric OS switch, show the running firmware from the command line:
firmwareshow
Compare the reported version with the ranges above. Do this on every switch and director in the fabric, including those in test and disaster recovery environments, since a single version table is easy to get wrong when switches were upgraded at different times.
Because this flaw needs local access, also review who holds accounts on the switches, including shared and vendor accounts, and who can reach the management network.
What to do now
- Read the Broadcom security advisory and confirm the fixed version for your product and platform.
- Inventory every affected instance, including copies in lab, test and disaster recovery sites.
- Schedule the upgrade, with a rollback plan, since these systems sit in storage network management.
- Limit management network access to administrators and jump hosts while you wait.
- Record versions in your asset inventory and subscribe to Broadcom security advisories for the product.
Why it matters
The weakness is missing authentication for a critical function (CWE-306). The web management daemon listens for local inter-process messages that register sessions. It accepts a session record, including the role, user identifier and authorization flags, without checking who sent it. Anything that can send that message can claim to be an administrator.
This is the kind of design mistake that appears when a trust boundary is assumed to be the machine rather than the process. Local processes are not all equal, and a low privilege account can often reach a local socket or queue.
The effect is administrator access on the web management interface without logging in. On a storage switch that means configuration changes, and so the standard defences apply: patch, control who has accounts and shell access, and keep the management network isolated.
Quick check
Do I need to be on the switch to exploit this?
The record describes local inter-process communication, so the attacker needs local access to the system.
Is 9.2.2d safe?
The records disagree. CVE-2026-87660 treats it as fixed, this record lists it as affected. Check Broadcom advisory 39164.
Sources
- Broadcom security advisory 39164 (cited by the record; not readable by my automated fetch)
- Safeguard Gold entry for CVE-2026-87664
Last reviewed: 18 October 2026.
