Brocade Fabric OS: Cross-Virtual-Fabric access via crafted fabric identifier
Summary
Brocade Fabric OS firmware for Fibre Channel SAN switches and directors contains an authorization and input validation flaw in Virtual Fabrics. An authenticated user with restricted privileges in one Virtual Fabric can submit a crafted request with an arbitrary fabric identifier. This allows unauthorized cross-fabric operations and viewing of configuration details of other tenants or Virtual Fabrics. Adjacent network access is required, and the attack is low complexity.
Affected
- Brocade Fabric OS versions before 9.2.2d
- Brocade Fabric OS versions 10.0.0 through 10.0.0a1
- Note: one advisory mirror lists the range as starting at 9.2.2b. Verify against Broadcom advisory 39081.
Fixed in
- Brocade Fabric OS 9.2.2d
- Brocade Fabric OS 10.0.1
- Note: one advisory mirror lists 9.2.2b as the fix. Verify against Broadcom advisory 39081 before relying on any version.
Workaround
Unknown.
Exploitation
- No public exploitation known at the time of review.
- Not listed in the CISA KEV catalog in the sources reviewed.
- CISA SSVC: exploitation none, not automatable, total technical impact.
Our recommendation
- Update Fabric OS to 9.2.2d or 10.0.1 (confirm the correct build in Broadcom advisory 39081).
- Review which accounts hold Virtual Fabric roles and remove unneeded low-privilege accounts.
- Restrict management access to the SAN management network.
- Monitor logs for unusual cross-fabric configuration queries.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Broadcom Security Advisory 39081 support.broadcom.com
- VulDB entry CVE-2026-87687 vuldb.com
- Strix CVE record CVE-2026-87687 www.strix.ai
- Broadcom PSIRT advisory 25000 support.broadcom.com
- Fabric OS on Wikipedia en.wikipedia.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:12.
Original description (NVD)
An authorization and input validation vulnerability exists in Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user with restricted privileges in one Virtual Fabric can exploit this issue by submitting a specially crafted request containing an arbitrary fabric identifier. This allows the user to perform unauthorized cross-fabric operations and view configuration details within tenants/Virtual Fabrics to which they have not been granted access.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.