Broadcom Fabric OS: Command injection in certificate management API
Summary
Fabric OS, the operating system of Brocade Fibre Channel SAN switches and directors, contains an input validation flaw in the certificate management part of its administrative API. An authenticated attacker with certificate deletion rights can inject operating system commands, which then run with the privileges of the management daemon. Exploitation requires high privileges and adjacent network access, and the impact on the switch is rated high for confidentiality, integrity and availability.
Affected
- Fabric OS before 9.2.2d
- Fabric OS 10.0.0 through 10.0.0a1
Fixed in
- Fabric OS 9.2.2d for the 9.x line
- 10.x: Fabric OS 10.0.1 according to the CVE record; third-party sources name other builds (10.0.0b, 10.0.0.1). Verify the exact 10.x build in Broadcom advisory 39072.
Workaround
- No vendor workaround identified. Check Broadcom advisory 39072 for official guidance.
- Restrict the switch management interface to a dedicated admin network, not reachable from user networks.
- Limit administrative and certificate management rights to the necessary accounts.
Exploitation
- No evidence of exploitation in the wild found.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- EPSS 0.13 percent. No public proof of concept found in the research.
Our recommendation
- Check whether Brocade, IBM or HPE Fibre Channel SAN switches or directors running Fabric OS are in use.
- Update to Fabric OS 9.2.2d or the fixed 10.x build named in advisory 39072 as soon as possible.
- Restrict management access to a dedicated network and review admin accounts, certificate changes and logs for unexpected entries.
- Patch together with the other High-risk Fabric OS advisories published in the same batch.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Broadcom Security Advisory 39072 support.broadcom.com
- VulDB CVE-2026-87688 vuldb.com
- VulDB 415235 vuldb.com
- Broadcom Support Portal Security Advisory 25000 support.broadcom.com
- Rapid7 via Vulners CVE-2026-87688 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:13.
Original description (NVD)
An input validation vulnerability exists in the security certificate management component of the Brocade Fabric OS administrative management API. When processing certificate management operations, user-supplied certificate identifiers are handled without adequate sanitization prior to execution in external system routines. An authenticated attacker with privileges to perform certificate deletion requests can leverage this flaw to execute arbitrary system commands with the privileges of the underlying management daemon. This vulnerability affects Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.