Broadcom Fabric OS: Arbitrary file manipulation in WebTools management interface
Summary
An authenticated administrator of Brocade Fabric OS can abuse an unvalidated status file path parameter in the WebTools management interface to make the system move an arbitrary system file to a world-readable temporary directory. Successful exploitation can lead to persistent denial of service, destruction of critical system files, host compromise or leakage of sensitive data. The attacker needs administrative credentials and adjacent network access; the CVSS 4.0 base score is 8.4.
Affected
- Brocade Fabric OS before 9.2.2d
- Brocade Fabric OS 10.0.0 through 10.0.0a1
- Not affected per the advisory: Brocade SANnav and ASCG
- Confirm the exact build for each switch model against the Broadcom advisory
Fixed in
- Brocade Fabric OS 9.2.2d
- Brocade Fabric OS 10.0.1
Workaround
Unknown. The workaround field of the Broadcom advisory could not be verified. Practical measures independent of the advisory:
- Disable plain HTTP for WebTools and use HTTPS only
- Restrict management access to a dedicated admin network
Exploitation
- Exploitation in the wild: no evidence found
- Public proof of concept: none found
- CISA SSVC assessment: exploitation none, not automatable
- CISA KEV status: not verified against the catalog
Our recommendation
- Plan the update to Fabric OS 9.2.2d or 10.0.1 in the next maintenance window
- Restrict WebTools access to admin networks and enforce HTTPS
- Review administrative accounts on SAN switches and remove unused ones
- Monitor switch logs for unexpected configuration transfer requests
- Relevance is limited to SMEs that operate Fibre Channel SANs; priority medium
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Broadcom Security Advisory 39079 support.broadcom.com
- Vulners: CVE-2026-87685 (NVD) vulners.com
- Vulners: CVE-2026-87685 (Rapid7) vulners.com
- Broadcom Fabric OS FOS Security Guide docs.broadcom.com
- Broadcom Fabric OS WebTools 10.0.x documentation techdocs.broadcom.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 12:44.
Original description (NVD)
An arbitrary file manipulation vulnerability exists in the WebTools management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When processing configuration transfer requests, the application fails to properly validate and sanitize a user-supplied status file path parameter. An authenticated administrative user can exploit this issue by submitting a specially crafted status file parameter, causing the underlying process to move an arbitrary system file to a predictable, world-readable temporary directory. This can lead to persistent Denial of Service (DoS), critical system file destruction, host compromise, or sensitive data leakage.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.