Description
A session context forgery vulnerability exists in the web management daemon of Brocade Fabric OS versions 9.2.2d and 10.0.0 through 10.0.0a1. When processing local inter-process communication (IPC) storage callbacks, the service accepts and registers session structures including administrative role permissions, user identifiers, and authorization flags—without verifying the identity or authenticity of the sending process. An attacker can obtain elevated administrative privileges on the web management interface without legitimate authentication.
Published: 2026-10-08
Score: 8.5 High
EPSS: n/a
KEV: No
Impact: Privilege Escalation via Web Management Interface
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is a session context forgery in the Brocade Fabric OS web management daemon that accepts session structures from any local process without authentication‑checking. An attacker can forge administrative session data, enabling them to assume full web management privileges without legitimate credentials.

Affected Systems

Brocade Fabric OS version 9.2.2d and 10.0.0 through 10.0.0a1 are impacted. 9.2.2d is affected in the 9.2.x branch and any 10.0.x release prior to 10.0.1 is also vulnerable.

Risk and Exploitability

The CVSS score of 8.5 indicates a high severity risk. EPSS data is not available, but the exploit requires local process interaction with the daemon, making it a local privilege escalation vector. The vulnerability is not listed in the CISA KEV catalog, yet the potential to gain unrestricted administrative access warrants urgent attention.

Generated by OpenCVE AI on October 8, 2026 at 05:23 UTC.

Remediation

Vendor Solution

Security update is provided in Brocade Fabric OS 9.2.2d and 10.0.1

OpenCVE Recommended Actions

  • Apply the security update to Fabric OS 9.2.2d or upgrade to Fabric OS 10.0.1 which contains the fix for the session context forgery
  • Disable or restrict IPC communications for the web management daemon until a patch is applied to prevent forged session data from being accepted
  • Configure the management network to isolate the web interface from untrusted systems and enforce strict role‑based access controls

Generated by OpenCVE AI on October 8, 2026 at 05:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 08 Oct 2026 05:45:00 +0000

Type Values Removed Values Added
First Time appeared Brocade
Brocade fabric Os
Vendors & Products Brocade
Brocade fabric Os

Thu, 08 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
Description A session context forgery vulnerability exists in the web management daemon of Brocade Fabric OS versions 9.2.2d and 10.0.0 through 10.0.0a1. When processing local inter-process communication (IPC) storage callbacks, the service accepts and registers session structures including administrative role permissions, user identifiers, and authorization flags—without verifying the identity or authenticity of the sending process. An attacker can obtain elevated administrative privileges on the web management interface without legitimate authentication.
Weaknesses CWE-306
References
Metrics cvssV4_0

{'score': 8.5, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Brocade Fabric Os
cve-icon MITRE

Status: PUBLISHED

Assigner: brocade

Published:

Updated: 2026-10-08T04:16:03.566Z

Reserved: 2026-09-08T22:51:12.105Z

Link: CVE-2026-87664

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-08T05:17:05.697

Modified: 2026-10-08T05:17:05.697

Link: CVE-2026-87664

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-08T05:30:17Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function