---
id: CVE-2026-87685
title: >-
  An arbitrary file manipulation vulnerability exists in the WebTools management
  interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through
  10.0.0a1
summary: >-
  An arbitrary file manipulation vulnerability exists in the WebTools management
  interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through
  10.0.0a1. When processing configuration transfer requests, the application
  fails to p…
severity: medium
cvss: 6.8
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-73
vendor: broadcom
product: fabric_operating_system
affected:
  - fabric_operating_system < 9.2.2d
  - 'fabric_operating_system >= 10.0.0, < 10.0.1'
patched:
  - fabric_operating_system 10.0.1
published: '2026-10-08'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T19:11:25.967'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-87685'
references:
  - url: 'https://support.broadcom.com/external/content/SecurityAdvisories/0/39079'
    label: sirt@brocade.com
tags:
  - nvd
  - cve.org
epss: 0.00183
epssPercentile: 0.07851
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-08T12:55:53.834840Z'
scores:
  nvd: 6.8
  cna: 8.4
ingestedAt: '2026-10-08T04:04:32.126Z'
---

## Overview

An arbitrary file manipulation vulnerability exists in the WebTools management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When processing configuration transfer requests, the application fails to properly validate and sanitize a user-supplied status file path parameter. An authenticated administrative user can exploit this issue by submitting a specially crafted status file parameter, causing the underlying process to move an arbitrary system file to a predictable, world-readable temporary directory. This can lead to persistent Denial of Service (DoS), critical system file destruction, host compromise, or sensitive data leakage.

## Affected

- `fabric_operating_system < 9.2.2d`
- `fabric_operating_system >= 10.0.0, < 10.0.1`

## Remediation

Upgrade past the affected range:

- `fabric_operating_system 10.0.1`