CVE-2026-87665 is a high severity stack buffer overflow flaw in Brocade Fabric OS, scored 7.5. Fabric OS 10.0.1 is the boundary named in the record, so 10.0.1 or later is the target. Check your installed version against the affected list below, then patch or restrict access until you can. The record does not flag it as exploited.
What's affected
- Brocade Fabric OS before 10.0.1.
- Exposure is described for extension switches or blades running IPsec-enabled FCIP circuits.
Severity in the record: High (7.5), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Weakness: CWE-121.
Fix: Fabric OS 10.0.1 is the boundary named in the record, so 10.0.1 or later is the target. Confirm in the Broadcom advisory. The record gives the affected range only. The exact fixed builds are listed in the Broadcom advisory, which you should read before scheduling the upgrade.
How to check if you're exposed
- Fabric OS exposes its running version from the switch command line. The
firmwareshowcommand is the usual way to read it; confirm the command and output format against your Fabric OS release documentation. - Repeat on every switch, director and extension blade, since versions can differ across a fabric.
- Compare each version with the affected range above and with the fixed builds named in the Broadcom advisory.
- Check whether IKEv2 with IPsec is configured on FCIP circuits. Devices without that feature enabled are outside the scenario the record describes.
Run these on every affected device, including ones in remote sites, labs and spares that are powered on.
What to do now
- Confirm the version of every affected system using the checks above.
- Read the vendor advisory linked in Sources and note the fixed version for your release line.
- Schedule the update, starting with systems that face untrusted networks or hold the most sensitive data.
- In the meantime: block UDP port 500 from untrusted networks to extension switches where your design allows it.
- Record the change, then recheck the version to confirm it took effect.
Why it matters
The IKEv2 handler copies an oversized Nonce payload into a fixed stack buffer without checking its length. That is a classic CWE-121 stack-based overflow. The record says one crafted UDP packet to port 500 from an unauthenticated source is enough, and the result is a crash of the data-plane process. It does not claim code execution.
The record's KEV flag is false, so this post makes no claim that the flaw is exploited in the wild. That can change, so recheck the CISA catalog from time to time.
Network and management devices are patched less often than servers, because upgrades mean planned downtime. That gap is where a flaw like this stays open longest, so build the version check into your regular inventory.
The vector string in the record is a compact summary of how the flaw is reached and what it costs. AV is the attack vector (network, adjacent or local), PR is the privilege the attacker needs, and the C, I and A letters give the impact on confidentiality, integrity and availability. Read it against your own network layout rather than relying on the score alone.
After you patch
Patching is not the end of the job. Recheck the version on each system, because an upgrade that failed or rolled back looks the same as a success until someone looks. Keep the advisory link with your change record so the next reviewer can see why the update happened.
If you cannot patch soon, write down the reason, the compensating control you chose and a date to revisit. Exceptions without a date tend to become permanent.
Quick check
Does this need credentials to trigger?
No. The record lists privileges required as none and the attack vector as network, with the impact limited to availability.
Sources
-
Broadcom advisory: 39148
-
Safeguard Gold: CVE-2026-87665
Last reviewed: 18 October 2026.
