---
id: CVE-2026-87672
title: >-
  An information disclosure vulnerability exists in the SupportLink diagnostic
  collection utilities of Brocade Fabric OS versions before 10.0.1
summary: >-
  An information disclosure vulnerability exists in the SupportLink diagnostic
  collection utilities of Brocade Fabric OS versions before 10.0.1. When
  SupportLink is configured to use an authenticated HTTP proxy, the system
  stores the full …
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-532
vendor: broadcom
product: fabric_operating_system
affected:
  - fabric_operating_system < 10.0.1
patched:
  - fabric_operating_system 10.0.1
published: '2026-10-08'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T14:05:59.953'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-87672'
references:
  - url: 'https://support.broadcom.com/external/content/SecurityAdvisories/0/39142'
    label: sirt@brocade.com
tags:
  - nvd
  - cve.org
epss: 0.00109
epssPercentile: 0.01242
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-08T13:14:06.821604Z'
scores:
  nvd: 5.5
  cna: 6.8
ingestedAt: '2026-10-08T03:03:35.540Z'
---

## Overview

An information disclosure vulnerability exists in the SupportLink diagnostic collection utilities of Brocade Fabric OS versions before 10.0.1. When SupportLink is configured to use an authenticated HTTP proxy, the system stores the full proxy URL. Anyone with access to the diagnostic support bundle, such as support personnel or users with access to file shares where support bundles are stored, can extract these cleartext proxy credentials.

## Affected

- `fabric_operating_system < 10.0.1`

## Remediation

Upgrade past the affected range:

- `fabric_operating_system 10.0.1`