Broadcom Fabric OS: Session context forgery in web management daemon
Summary
The web management daemon of Brocade Fabric OS accepts session structures from local inter-process communication without verifying the sending process. An attacker with a local, low-privilege foothold on the device can register a forged session with administrative rights and gain elevated access to the web management interface without legitimate authentication. The affected versions conflict between sources, so the advisory must be checked before acting.
Affected
Unknown. Sources conflict: CNA/NVD metadata lists versions below 9.2.2d and 10.0.0 through 10.0.0a1, while the CVE description names 9.2.2d and 10.0.0 through 10.0.0a1. Confirm in advisory 39164.
Fixed in
Probably Brocade Fabric OS 9.2.2d and 10.0.1, according to a mirror of the advisory text. Not yet verified against Broadcom's advisory.
Workaround
Unknown. No vendor workaround found. - Restrict access to the switch management interface to administrators. - Review local accounts on the switch.
Exploitation
No CISA KEV listing found. No public proof of concept found, but search coverage was limited. CISA SSVC: exploitation none, not automatable, total technical impact.
Our recommendation
- Inventory Brocade/Fabric OS switches and their exact firmware versions. - Read advisory 39164 to confirm affected and fixed builds. - Upgrade to a fixed release, prioritising switches whose management interface is reachable from user networks. - Check CVE-2026-94585 (MXG610, network-adjacent) at the same time. - Re-check CISA KEV and exploit sources periodically.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Broadcom Security Advisory 39164 support.broadcom.com
- VulDB CVE-2026-87664 vuldb.com
- VulDB vulnerability 415263 vuldb.com
- Vulners CVE record (CVELIST) vulners.com
- Strix CVE-2026-87664 www.strix.ai
- Advisory mirror CVE-2026-87664 cve.imfht.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:12.
Original description (NVD)
A session context forgery vulnerability exists in the web management daemon of Brocade Fabric OS versions 9.2.2d and 10.0.0 through 10.0.0a1. When processing local inter-process communication (IPC) storage callbacks, the service accepts and registers session structures including administrative role permissions, user identifiers, and authorization flags—without verifying the identity or authenticity of the sending process. An attacker can obtain elevated administrative privileges on the web management interface without legitimate authentication.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.