CVE-2026-87687CWE-88

CVE-2026-87687

High · published October 8, 2026

CVSS v3.1
7.3
EPSS
0%
Percentile
10.5
In the wild
Unconfirmed
What it is

An authorization and input validation vulnerability exists in Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user with restricted privileges in one Virtual Fabric can exploit this issue by submitting a specially crafted request containing an arbitrary fabric identifier. This allows the user to perform unauthorized cross-fabric operations and view configuration details within tenants/Virtual Fabrics to which they have not been granted access.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
8.5 · CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00209 · 10.5th percentile
Weakness
CWE-88 · Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Published
2026-10-08T08:17Z
Affected products (2)
ProductVersionsFixed in
broadcom/fabric_operating_system< 9.2.2d9.2.2d
broadcom/fabric_operating_system≥ 10.0.0, < 10.0.110.0.1
References (1)
https://support.broadcom.com/external/content/SecurityAdvisories/0/39081 · [email protected]
EPSS history
Timeline
  • 09 OCT 03:32Z
    EPSS moved — → 0%
    epss
  • 08 OCT 03:26Z
    An authorization and input validation vulnerability exists in Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1
    cvelistv5
  • 08 OCT 03:26Z
    An authorization and input validation vulnerability exists in Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1
    cvelistv5