---
id: CVE-2026-87669
title: >-
  A missing authorization check in Brocade Fabric OS versions before 10.0.1 REST
  API interface of affected platform releases allows an authenticated user,
  regardless of their assigned role or administrative scope, to retrieve
  complete Moni…
summary: >-
  A missing authorization check in Brocade Fabric OS versions before 10.0.1 REST
  API interface of affected platform releases allows an authenticated user,
  regardless of their assigned role or administrative scope, to retrieve
  complete Moni…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-862
vendor: broadcom
product: fabric_operating_system
affected:
  - fabric_operating_system < 10.0.1
patched:
  - fabric_operating_system 10.0.1
published: '2026-10-08'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T17:17:43.257'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-87669'
references:
  - url: 'https://support.broadcom.com/external/content/SecurityAdvisories/0/39139'
    label: sirt@brocade.com
tags:
  - nvd
  - cve.org
epss: 0.00178
epssPercentile: 0.07262
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-08T13:16:31.788392Z'
scores:
  nvd: 4.3
  cna: 5.1
ingestedAt: '2026-10-08T03:03:35.542Z'
---

## Overview

A missing authorization check in Brocade Fabric OS versions before 10.0.1 REST API interface of affected platform releases allows an authenticated user, regardless of their assigned role or administrative scope, to retrieve complete Monitoring and Alerting Policy Suite (MAPS) violation data across all logical switches. An attacker with low-privilege API access can leverage this endpoint to dump chassis-wide system health metrics, port performance violations, and configuration data without appropriate privileges.

## Affected

- `fabric_operating_system < 10.0.1`

## Remediation

Upgrade past the affected range:

- `fabric_operating_system 10.0.1`