CVE-2026-87659
Critical
9.8 CVSS v3.1
CVSS v4.0: 7.1
- Published
- Oct 8, 2026
- Updated
- Oct 13, 2026
- Vendor
- Broadcom
- Affected versions
- See affected products
- Weakness
- CWE-306
Summary
A critical authorization bypass vulnerability exists in the Management Server handling of Brocade Fabric OS versions before 10.0.1. A compromised switch connected to the fabric can transmit crafted inband Fibre Channel vendor-unique CT (Common Transport) management requests to bypass administrative authentication. Successful exploitation allows an unauthorized peer switch to execute administrative actions on the target device, including resetting administrative passwords, initiating system reboots, and triggering firmware downloads.
Severity
Critical (9.8)CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0 (7.1)
CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Affected products
- Broadcom Fabric Operating System < 10.0.1
Exploitation status
Unknown
Technical details
Technical analysis has not been written for this record yet.
Mitigation & remediation
Follow the vendor advisory linked below for patches and workarounds.