---
id: CVE-2026-87681
title: >-
  An Access Control Bypass vulnerability exists in the Role-Based Access Control
  (RBAC) validation engine of Brocade Fabric OS versions before 10.0.1
summary: >-
  An Access Control Bypass vulnerability exists in the Role-Based Access Control
  (RBAC) validation engine of Brocade Fabric OS versions before 10.0.1. When
  processing certain management protocol operations, the RBAC engine incorrectly
  cate…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'
cwe:
  - CWE-269
vendor: broadcom
product: fabric_operating_system
affected:
  - fabric_operating_system < 10.0.1
patched:
  - fabric_operating_system 10.0.1
published: '2026-10-08'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T14:13:31.013'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-87681'
references:
  - url: 'https://support.broadcom.com/external/content/SecurityAdvisories/0/39075'
    label: sirt@brocade.com
tags:
  - nvd
  - cve.org
epss: 0.00197
epssPercentile: 0.09342
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-08T13:39:49.969555Z'
scores:
  nvd: 6.3
  cna: 7.1
ingestedAt: '2026-10-08T01:01:40.725Z'
---

## Overview

An Access Control Bypass vulnerability exists in the Role-Based Access Control (RBAC) validation engine of Brocade Fabric OS versions before 10.0.1. When processing certain management protocol operations, the RBAC engine incorrectly categorizes non-standard action opcodes during permission checks. This allows authenticated users with read-only management privileges to bypass access controls and execute restricted administrative operations.

## Affected

- `fabric_operating_system < 10.0.1`

## Remediation

Upgrade past the affected range:

- `fabric_operating_system 10.0.1`