---
id: CVE-2026-87664
title: >-
  A session context forgery vulnerability exists in the web management daemon of
  Brocade Fabric OS versions 9.2.2d and 10.0.0 through 10.0.0a1
summary: >-
  A session context forgery vulnerability exists in the web management daemon of
  Brocade Fabric OS versions 9.2.2d and 10.0.0 through 10.0.0a1. When processing
  local inter-process communication (IPC) storage callbacks, the service accepts
  …
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-306
vendor: broadcom
product: fabric_operating_system
affected:
  - fabric_operating_system < 9.2.2d
  - 'fabric_operating_system >= 10.0.0, < 10.0.1'
patched:
  - fabric_operating_system 10.0.1
published: '2026-10-08'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T19:33:18.963'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-87664'
references:
  - url: 'https://support.broadcom.com/external/content/SecurityAdvisories/0/39164'
    label: sirt@brocade.com
tags:
  - nvd
  - cve.org
epss: 0.00118
epssPercentile: 0.01727
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-08T15:18:57.962028Z'
scores:
  nvd: 7.8
  cna: 8.5
ingestedAt: '2026-10-08T05:05:36.681Z'
---

## Overview

A session context forgery vulnerability exists in the web management daemon of Brocade Fabric OS versions 9.2.2d and 10.0.0 through 10.0.0a1. When processing local inter-process communication (IPC) storage callbacks, the service accepts and registers session structures including administrative role permissions, user identifiers, and authorization flags—without verifying the identity or authenticity of the sending process. An attacker can obtain elevated administrative privileges on the web management interface without legitimate authentication.

## Affected

- `fabric_operating_system < 9.2.2d`
- `fabric_operating_system >= 10.0.0, < 10.0.1`

## Remediation

Upgrade past the affected range:

- `fabric_operating_system 10.0.1`