CVE-2026-87670CWE-290
CVE-2026-87670
Medium · published October 8, 2026
What it is
An authorization logic vulnerability exists in the Brocade Fabric OS versions before 10.0.1 REST API gateway. The internal gate guarding restricted management endpoints relies exclusively on client-controlled HTTP headers. An authenticated user with any valid REST session can spoof these headers to gain unauthorized access to internal management endpoints. This allows low-privilege users to view sensitive chassis metadata, hardware memory patrolling state, and firmware integrity audit logs.
The record
Technical detail
- CVSS v3.1
- 4.3 · MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- CVSS v4.0
- 5.1 · CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
- EPSS
- 0.00178 · 7.0th percentile
- Weakness
- CWE-290 · Authentication Bypass by Spoofing
- Published
- 2026-10-08T07:16Z
Affected products (1)
| Product | Versions | Fixed in |
|---|
| broadcom/fabric_operating_system | < 10.0.1 | 10.0.1 |
References (1)
EPSS history
Timeline
09 OCT 03:32Z
EPSS moved — → 0%
epss
08 OCT 02:51Z
An authorization logic vulnerability exists in the Brocade Fabric OS versions before 10.0.1 REST API gateway
cvelistv5
08 OCT 02:51Z
An authorization logic vulnerability exists in the Brocade Fabric OS versions before 10.0.1 REST API gateway
cvelistv5