---
id: CVE-2026-87659
title: >-
  A critical authorization bypass vulnerability exists in the Management Server
  handling of Brocade Fabric OS versions before 10.0.1
summary: >-
  A critical authorization bypass vulnerability exists in the Management Server
  handling of Brocade Fabric OS versions before 10.0.1. A compromised switch
  connected to the fabric can transmit crafted inband Fibre Channel
  vendor-unique CT (…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-306
vendor: broadcom
product: fabric_operating_system
affected:
  - fabric_operating_system < 10.0.1
patched:
  - fabric_operating_system 10.0.1
published: '2026-10-08'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T17:25:28.650'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-87659'
references:
  - url: 'https://support.broadcom.com/external/content/SecurityAdvisories/0/39153'
    label: sirt@brocade.com
tags:
  - nvd
  - cve.org
  - score-dispute
epss: 0.00241
epssPercentile: 0.15123
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-08T15:19:05.618383Z'
scores:
  nvd: 9.8
  cna: 7.1
ingestedAt: '2026-10-08T03:03:35.548Z'
---

## Overview

A critical authorization bypass vulnerability exists in the Management Server handling of Brocade Fabric OS versions before 10.0.1. A compromised switch connected to the fabric can transmit crafted inband Fibre Channel vendor-unique CT (Common Transport) management requests to bypass administrative authentication. Successful exploitation allows an unauthorized peer switch to execute administrative actions on the target device, including resetting administrative passwords, initiating system reboots, and triggering firmware downloads.

## Affected

- `fabric_operating_system < 10.0.1`

## Remediation

Upgrade past the affected range:

- `fabric_operating_system 10.0.1`