CVE-2026-87659

Executive Summary

CVE-2026-87659 is a critical authorization bypass in the Management Server component of Brocade Fabric OS versions prior to 10.0.1. An attacker controlling a compromised switch that is already connected to the Fibre Channel fabric can send crafted inband vendor-unique Common Transport (CT) management requests that bypass administrative authentication entirely. Successful exploitation permits an unauthorized peer switch to perform privileged administrative actions on the target device, including resetting administrative passwords, triggering system reboots, and initiating firmware downloads — effectively yielding full fabric-wide control from a single low-trust node.

Technical Analysis

The vulnerability resides in the Management Server's handling of inband management traffic. Fibre Channel fabrics carry two distinct planes of traffic: data-plane traffic between initiators and targets, and inband management traffic used by fabric services and switches to exchange control information. The Management Server is a fabric service that brokers management requests, and it communicates with peer switches over the Common Transport (CT) protocol using vendor-unique command codes.

CVE-2026-87659 stems from a missing authentication check for a security-relevant function — classified under CWE-306, Missing Authentication for Critical Function. The Management Server processes certain vendor-unique CT management requests without verifying that the requesting peer is authorized to perform administrative operations. Because the requests arrive inband over the Fibre Channel fabric rather than over a separate out-of-band management channel, any node that can inject CT frames into the fabric can reach the vulnerable code path.

Three properties make this particularly dangerous:

1. Trust boundary collapse. The fabric implicitly trusts inband CT traffic from connected switches. The Management Server treats vendor-unique CT requests as coming from a trusted fabric peer, so authorization is never enforced for the administrative actions those requests can invoke.
2. Inband reachability. No management network access, no IP connectivity, and no credentials are required to reach the vulnerable interface — only a port connected to the fabric.
3. Privileged action set. The requests reach administrative functions capable of resetting administrative passwords, initiating system reboots, and triggering firmware downloads. These are not read-only information disclosures; they are state-changing operations.

The specific vendor-unique CT command codes, request structure, and the exact authentication routine that fails to run are not documented in the available advisory text. What is clear is the vulnerability class: a critical function reachable over an inband protocol path that lacks any authentication gate. Fabric OS versions before 10.0.1 are affected.

Exploitation Scenarios

The attack chain below is inferred from the vulnerability class and the advisory description. No public proof-of-concept or exploit code is available for CVE-2026-87659.

1) Reconnaissance / target identification. The attacker establishes a foothold on any device that is connected to the target Fibre Channel fabric — most plausibly a switch that has already been compromised through a separate intrusion, a rogue switch, or a malicious fabric node. Because the flaw is exploitable inband, the attacker does not need IP reachability to the management interface, a valid administrative account, or access to an out-of-band management network. The attacker only needs the ability to transmit Fibre Channel frames to fabric peers. Discovery of the target's domain ID and the presence of the Management Server service on the fabric is straightforward for any connected node.

2) Triggering the flaw class. The attacker crafts inband Fibre Channel vendor-unique Common Transport (CT) management requests and transmits them toward the target device. These requests traverse the fabric as normal inband management traffic and are delivered to the Management Server service. Because the Management Server fails to perform an authentication check on this class of vendor-unique CT request (CWE-306), it processes the request as though it originated from an authorized administrative peer. The authorization bypass occurs at the point where the request would normally be validated — the validation step is either absent or not reached for this request type.

3) Payload / execution method. Once the request is accepted, the administrative function associated with that vendor-unique CT command is invoked on the target. At the vulnerability-class level, this is a direct invocation of privileged management functionality without credentials: the attacker does not need to escalate privileges because the vulnerable interface itself acts as the privileged path. The advisory explicitly identifies three administrative outcomes that can be reached: resetting administrative passwords, initiating system reboots, and triggering firmware downloads.

4) Post-exploitation impact. A successful password reset gives the attacker persistent administrative access to the target switch using credentials of their choosing. A system reboot offers a denial-of-service lever over fabric availability. A triggered firmware download creates a path for introducing attacker-controlled software onto the device. Because the target is a fabric switch, compromise has a blast radius well beyond the single device — the switch is a control point for the fibre channel fabric it participates in.

No public PoC is available; this attack chain is inferred from the vulnerability class and the advisory description.

Impact Assessment

The impact is severe and scoped to the fabric rather than a single host. CVSS is not published (N/A), but an assessment based on the described properties yields:

• Attack Vector: Adjacent (AV:A) — the attacker must be on the fabric, but not on the management network.
• Attack Complexity: Low (AC:L) — no special conditions beyond fabric membership are described.
• Privileges Required: None (PR:N) — the entire point of the flaw is that no authentication is needed.
• User Interaction: None (UI:N) — the requests are machine-to-machine.
• Scope: Changed (S:C) — compromise of a connected switch affects the fabric and its peers.
• Confidentiality/Integrity/Availability: High (C:H/I:H/A:H) — administrative password reset, forced reboot, and firmware download each independently break all three.

Business impact includes fabric-wide administrative takeover, loss of management integrity, and the ability to push untrusted firmware onto storage-networking infrastructure. An attacker with fabric access can pivot from a single node to control of the environment's most trusted network segment. EPSS is 0.00144 (3.2nd percentile), and CVE-2026-87659 is not in CISA KEV; there is no evidence of in-the-wild exploitation at the time of writing. Exploitation is nonetheless plausible given that the flaw requires only fabric membership.

Detection Guidance

Sigma Rule

title: Suspicious Fibre Channel Inband Vendor-Unique CT Management Request
id: 8f1c2d44-7b6a-4e9c-9d2f-1e5a3b7c0a91
status: experimental
description: Detects administrative actions on Brocade Fabric OS consistent with CVE-2026-87659 authorization bypass via inband vendor-unique CT management requests.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87659
author: valtersit.com
date: 2026/01/01
logsource:
  product: brocade
  service: fabric_os
detection:
  selection_events:
    event.action:
      - 'admin_password_reset'
      - 'system_reboot'
      - 'firmware_download'
  selection_source:
    source.type: 'inband_ct'
  condition: selection_events and selection_source
falsepositives:
  - Legitimate fabric administrative operations performed out-of-band
level: high
tags:
  - attack.t1190
  - cve.2026.87659

YARA Rule

rule CVE_2026_87659_FabricOS_CT_AuthBypass
{
    meta:
        description = "Detects indicators of CVE-2026-87659 authorization bypass activity in Brocade Fabric OS management server logs and captures"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87659"
        date = "2026-01-01"
        severity = "critical"

    strings:
        $ct = "vendor-unique CT" ascii nocase
        $mgmt = "Management Server" ascii nocase
        $pwreset = "password reset" ascii nocase
        $reboot = "reboot" ascii nocase
        $fwdl = "firmware download" ascii nocase
        $bypass = "authentication bypass" ascii nocase

    condition:
        uint32(0) == 0x0B10F500 or
        (2 of ($ct, $mgmt) and 1 of ($pwreset, $reboot, $fwdl, $bypass))
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-87659 Brocade Fabric OS Inband Vendor-Unique CT Management Auth Bypass Attempt"; flow:to_server,established; content:"|0B 10 F5|"; depth:3; content:"|FF FF|"; offset:6; depth:2; threshold:type limit, track by_src, count 1, seconds 60; classtype:attempted-admin; reference:cve,2026-87659; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-87659; sid:202687659; rev:1;)

Elastic Detection

sequence by host.id with maxspan=2m
  [ network where network.transport == "fc" and network.direction == "inbound" ]
  [ process where event.action in ("admin_password_reset", "system_reboot", "firmware_download") ]

Splunk SPL Query

index=network sourcetype=brocade:fabricos
| search ("vendor-unique" OR "CT management" OR "inband")
| rex field=_raw "(?<action>password_reset|reboot|firmware_download)"
| stats count min(_time) as first_seen max(_time) as last_seen values(action) as actions by src, dest
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="brocade,fabricos,">
  <rule id="202687659" level="13">
    <decoded_as>brocade-fabricos</decoded_as>
    <match>vendor-unique CT|inband management|Management Server</match>
    <regex>password_reset|reboot|firmware_download</regex>
    <description>CVE-2026-87659: Possible Brocade Fabric OS administrative action via unauthenticated inband vendor-unique CT request</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version list has been published in any tracked source; the Fabric OS 10.0.1 baseline referenced in the advisory is the closest available guidance and should be validated directly with the vendor.

1) Immediate mitigations

• Enforce strict zoning and fabric membership controls so that only authorized, managed switches can inject inband management traffic. Restrict the set of nodes permitted to send CT management requests to the fabric.
• Isolate and monitor any switch that may have been compromised. Because the exploit path is inband, a compromised switch is sufficient to reach the vulnerable interface — treat any untrusted or unknown node on the fabric as an active threat to Management Server.
• Monitor for the three administrative outcomes called out in the advisory — administrative password resets, unexpected reboots, and unsolicited firmware downloads — and treat any occurrence without a corresponding authorized change as an incident.
• Where feasible, disable unnecessary inband management functions and audit Management Server configuration for any reduction in the trusted peer set.

2) Patch / upgrade steps

• No patch is available in any tracked source. Do not assume a fixed version exists without confirmation from the vendor.
• Engage Brocade (Broadcom) support directly to confirm the fixed release and applicable migration path. The advisory references Fabric OS 10.0.1 as the affected baseline boundary; validate this with the vendor rather than assuming.
• Track the NVD entry for CVE-2026-87659 for a vendor fix reference and update the patch confidence when a fixed version is published.

3) Long-term hardening

• Enforce authentication and authorization on all inband management request paths, including vendor-unique CT command handling, rather than trusting fabric membership as an implicit credential.
• Segment management planes; require out-of-band administrative channels with strong authentication for password resets and firmware operations.
• Apply firmware image signing and verification to prevent attacker-supplied images from being installed via triggered firmware downloads.
• Continuously validate fabric topology and trust; alert on any new or unexpected node that begins emitting CT management traffic.

References

• NVD — CVE-2026-87659: https://nvd.nist.gov/vuln/detail/CVE-2026-87659
• BROCADE Fabric OS security advisories (vendor): https://www.broadcom.com/support/fibre-channel-networking/security-advisories
• MITRE ATT&CK — T1190, Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CWE-306 — Missing Authentication for Critical Function: https://cwe.mitre.org/data/definitions/306.html
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog