Description
A critical authorization bypass vulnerability exists in the Management Server handling of Brocade Fabric OS versions before 10.0.1. A compromised switch connected to the fabric can transmit crafted inband Fibre Channel vendor-unique CT (Common Transport) management requests to bypass administrative authentication. Successful exploitation allows an unauthorized peer switch to execute administrative actions on the target device, including resetting administrative passwords, initiating system reboots, and triggering firmware downloads.
Published: 2026-10-08
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized administrative control of Fabric OS devices
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is an authorization bypass in the Fabric OS Management Server for versions earlier than 10.0.1. An attacker who can inject specially crafted inband Fibre Channel vendor-unic CT requests from a compromised switch can bypass authentication. The weakness is a CWE-306 (Missing Authentication) issue. Successful exploitation allows the attacker to perform administrative functions such as resetting passwords, rebooting the target, or force-down loading firmware, thereby effectively taking control of the device.

Affected Systems

Brocade Fabric OS, impact only on firmware versions prior to 10.0.1. Devices running the referenced firmware are susceptible to exploitation without requiring additional credentials.

Risk and Exploitability

The vulnerability carries a CVSS score of 7.1, indicating moderate to high risk. EPSS data is not available, and the flaw is not listed in CISA’s KEV catalog. The likely attack vector involves a malicious or infected peer switch that sends crafted CT requests across the fabric network; exploitation requires no user interaction on the target switch and can be carried out directly from within the fabric.

Generated by OpenCVE AI on October 8, 2026 at 03:51 UTC.

Remediation

Vendor Solution

Security update is provided in Brocade Fabric OS 10.0.1

OpenCVE Recommended Actions

  • Install the security update contained in Brocade Fabric OS 10.0.1 or later to address the authorization bypass.
  • Physically isolate or re‑segment the compromised switch to prevent it from communicating inband CT packets with the target device.
  • Implement strict fabric authentication or network segmentation policies to ensure only trusted switches can issue management requests, and monitor for anomalous CT traffic.

Generated by OpenCVE AI on October 8, 2026 at 03:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 17:45:00 +0000

Type Values Removed Values Added
First Time appeared Broadcom
Broadcom fabric Operating System
CPEs cpe:2.3:o:broadcom:fabric_operating_system:*:*:*:*:*:*:*:*
Vendors & Products Broadcom
Broadcom fabric Operating System
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Thu, 08 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 08 Oct 2026 04:15:00 +0000

Type Values Removed Values Added
Title Fabric OS Authorization Bypass via Crafted CT Requests

Thu, 08 Oct 2026 03:45:00 +0000

Type Values Removed Values Added
First Time appeared Brocade
Brocade fabric Os
Vendors & Products Brocade
Brocade fabric Os

Thu, 08 Oct 2026 02:45:00 +0000

Type Values Removed Values Added
Description A critical authorization bypass vulnerability exists in the Management Server handling of Brocade Fabric OS versions before 10.0.1. A compromised switch connected to the fabric can transmit crafted inband Fibre Channel vendor-unique CT (Common Transport) management requests to bypass administrative authentication. Successful exploitation allows an unauthorized peer switch to execute administrative actions on the target device, including resetting administrative passwords, initiating system reboots, and triggering firmware downloads.
Weaknesses CWE-306
References
Metrics cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Broadcom Fabric Operating System
Brocade Fabric Os
cve-icon MITRE

Status: PUBLISHED

Assigner: brocade

Published:

Updated: 2026-10-08T17:57:09.189Z

Reserved: 2026-09-08T22:51:12.105Z

Link: CVE-2026-87659

cve-icon Vulnrichment

Updated: 2026-10-08T15:19:06.615Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-08T03:16:35.820

Modified: 2026-10-13T17:25:28.650

Link: CVE-2026-87659

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-08T04:00:11Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function