CVE-2026-87659
Broadcom Fabric Operating System: missing authentication
- Risk score
- 67/100
- CVSS
- 9.8 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 8 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A critical authorization bypass vulnerability exists in the Management Server handling of Brocade Fabric OS versions before 10.0.1. A compromised switch connected to the fabric can transmit crafted inband Fibre Channel vendor-unique CT (Common Transport) management requests to bypass administrative authentication. Suc…
- Affected
- Broadcom Fabric Operating System before 10.0.1
- Fix
- Upgrade Broadcom Fabric Operating System to 10.0.1 or later.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.8 critical
- Remotely exploitable without logging in
References
Original description
A critical authorization bypass vulnerability exists in the Management Server handling of Brocade Fabric OS versions before 10.0.1. A compromised switch connected to the fabric can transmit crafted inband Fibre Channel vendor-unique CT (Common Transport) management requests to bypass administrative authentication. Successful exploitation allows an unauthorized peer switch to execute administrative actions on the target device, including resetting administrative passwords, initiating system reboots, and triggering firmware downloads.
Last activity 8 Oct 2026. Patch Forecast updates every hour.