CVE-2026-87661

Executive Summary

CVE-2026-87661 is a persistent denial-of-service vulnerability in Brocade Fabric OS affecting versions before 9.2.2d and 10.0.0 through 10.0.0a1. During service setup or re-initialization, affected systems directly accept Apache configuration file data without adequate validation, allowing an attacker capable of corrupting the configuration structure to prevent the web management service from starting or recovering, resulting in a persistent DoS of the administrative web interface. Systems relying on the Brocade web management interface for SAN fabric administration are at risk of losing web-based administrative access until manual recovery is performed.

Technical Analysis

The vulnerability is classified as CWE-93 (Improper Neutralization of CRLF Sequences, often referred to in the broader class as injection through control/structure characters in configuration context). Per the NVD description, Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 "directly accepts Apache configuration file data during service setup or re-initialization."

The core mechanism is as follows: the web management service of Brocade Fabric OS is backed by an Apache (HTTP server) component. During service setup or re-initialization, the product ingests configuration file data. Because this Apache configuration data is accepted directly — that is, without adequate sanitization, structural validation, or integrity checking — an attacker who can corrupt the configuration structure can cause the web management service to fail to start or fail to recover during service bring-up.

Key characteristics derivable from the description:

• Attack surface: The web management service and its Apache-based configuration ingestion path, exercised specifically during service setup or re-initialization (i.e., a lifecycle event rather than a normal request-handling path).
• Precondition: The attacker must be "capable of corrupting the configuration structure." This implies a position of influence over the configuration data that the service consumes at bring-up time. The description does not specify the exact ingress vector (local file write, adjacent management interface, or otherwise), and no additional technical detail is available. Analysts should treat the precise precondition as environment-dependent.
• Vulnerability class: Improper handling of structural/control content in configuration data (CWE-93). The malformed or corrupted configuration structure is accepted rather than rejected, so the failure manifests at service startup rather than being caught and remediated at ingestion.
• Impact type: Availability only. The consequence is not code execution or data disclosure; it is the inability of the web management service to start or recover.
• Persistence: Because the corruption affects the service configuration itself, the failure recurs on every service bring-up — this is what makes the DoS "persistent" rather than transient. Restarting the service alone is unlikely to restore functionality if the corrupted configuration persists.

The NVD description does not disclose specific file paths, internal function names, or the exact Apache configuration directives involved. No public PoC, exploit code, or Nuclei template is available per the provided data. The attack chain must therefore be reasoned about at the vulnerability-class level.

Exploitation Scenarios

No public proof-of-concept exists for this vulnerability. The attack chain below is inferred from the vulnerability class (CWE-93 structural corruption of ingested configuration data) and the NVD description. Specific file paths, endpoints, and parameters are not provided in the source data and are deliberately not fabricated here.

1. Reconnaissance / target identification. An adversary identifies a Brocade Fabric OS deployment running an affected version (< 9.2.2d, or 10.0.0 through 10.0.0a1) that exposes a web management service. Targets are SAN switches/Fabric OS instances where the administrative web interface is a primary management channel. Public scanning can be used to locate exposed web management interfaces on Brocade-managed infrastructure (see Shodan dorks in METADATA).

2. Triggering the flaw class. The vulnerability is triggered during service setup or re-initialization, at the point where the product directly accepts Apache configuration file data. The attacker, having obtained the capability to corrupt the configuration structure, supplies or induces malformed/structurally invalid configuration content. Because the product "directly accepts" this data — i.e., it does not neutralize or reject the corrupting content — the bad structure is persisted into the Apache-backed web management service configuration.

3. Payload / execution method (class level). At the vulnerability-class level, the "payload" is structurally corrupting configuration content — content that alters or breaks the expected structure of the Apache configuration so that the web management service cannot parse or start correctly on the next bring-up. The specific byte sequences or injection technique are not disclosed in the source data. No file path or directive name is provided and none is asserted here.

4. Post-exploitation impact. On the next service setup or re-initialization (including recovery attempts), the web management service fails to start because the corrupted configuration is consumed again. This produces a persistent denial of service of the administrative web interface. The attacker does not obtain code execution, privilege escalation, or data access — the sole demonstrated impact is loss of web-based administrative availability.

Because the description states the attacker must be "capable of corrupting the configuration structure," the practical exploitability is gated by how that capability is obtained in a given environment. This precondition is not further elaborated in the available data.

Impact Assessment

The impact is availability-focused. A successful exploitation denies administrators access to the Brocade Fabric OS web management interface and renders that service unable to start or recover across restarts, because the corrupted configuration persists.

• Confidentiality: None stated. The description describes no data exposure.
• Integrity: None stated as the objective; corruption of configuration structure is the mechanism, not the sought outcome.
• Availability: High impact — the web management service is rendered persistently unavailable. Under a standard CVSS 3.1 scoring model, an availability-only flaw of this nature maps to a high availability impact (A:H) with no confidentiality or integrity impact (C:N/I:N/A:H).

Business impact: SAN fabric administration frequently relies on web-based management tools for configuration, monitoring, and zoning. Loss of the web management service degrades operational visibility and forces administrators onto alternative management paths (e.g., CLI) or manual recovery procedures to restore the interface. For environments with no alternative management path, this can impede routine SAN operations and incident response.

Blast radius: Each affected, exposed Brocade Fabric OS instance that meets the exploitation precondition can be independently denied web management. The description does not indicate cross-instance propagation; the impact is per-device. Fabric-level operational risk depends on how many managed switches are affected and how central the web interface is to that environment's workflows.

Note: The provided CVSS metrics field is N/A. No official CVSS score or vector is published in the supplied data; the vector in METADATA is an analyst-derived representation of the described impact and should be treated as illustrative, not authoritative.

Detection Guidance

Detection should focus on chronicling configuration changes to the web management service, failed service bring-up events, and anomalous writes to configuration data associated with the Apache-backed management service. Because the vulnerability is triggered at service setup/re-initialization, detections emphasize lifecycle and configuration-integrity telemetry rather than exploit payload signatures.

Sigma Rule

title: Brocade Fabric OS Web Management Service Startup Failure After Config Corruption
id: 7c9e1b2a-4d3f-4a8e-9b1c-2f5a6d7e8f90
status: experimental
description: Detects repeated failure of the Brocade web management (Apache-backed) service to start or recover, consistent with CVE-2026-87661 persistent DoS.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87661
author: valtersit.com
date: 2026/01/01
logsource:
  product: brocade
  service: fabricos
detection:
  selection_service:
    service_name|contains:
      - 'web management'
      - 'httpd'
      - 'apache'
  selection_failure:
    status|contains:
      - 'failed'
      - 'failure'
      - 'unable to start'
      - 'configuration'
  condition: selection_service and selection_failure
falsepositives:
  - Legitimate administrative restarts
  - Planned maintenance windows
level: medium
tags:
  - attack.t1190
  - cve.2026.87661

YARA Rule

rule CVE_2026_87661_Brocade_Apache_Config_Corruption
{
    meta:
        author = "valtersit.com"
        description = "Detects corrupted Apache configuration content associated with Brocade Fabric OS CVE-2026-87661"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87661"
        date = "2026-01-01"
        cve = "CVE-2026-87661"

    strings:
        $apache_dir = "<Directory" ascii nocase
        $apache_vhost = "<VirtualHost" ascii nocase
        $brocade_marker = "Brocade" ascii nocase
        $webmgmt = "web management" ascii nocase
        $crlf = { 0D 0A }
        $nullbyte = { 00 }

    condition:
        uint32(0) != 0x504B0304 and
        filesize < 2MB and
        (
            ($apache_dir or $apache_vhost) and
            ($brocade_marker or $webmgmt) and
            (#crlf > 20)
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-87661 Brocade Fabric OS Web Management Config Corruption Attempt"; flow:established,to_server; http.method; content:"POST"; http.header; content:"Content-Type|3a 20|"; content:"Brocade"; http.uri; content:"setup|3b|"; nocase; classtype:attempted-dos; reference:cve,2026-87661; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-87661; sid:202687661; rev:1;)

Elastic Detection

sequence by host.id with maxspan=10m
  [ process where event.action == "start" and process.name : ("httpd", "apache", "httpd2") ]
  [ process where event.action == "exit" and process.exit_code != 0 and
      process.name : ("httpd", "apache", "httpd2") ]
  [ file where event.action : ("creation", "change", "modification") and
      file.path : "*httpd*.conf*" ]

Splunk SPL Query

index=brocade OR index=syslog sourcetype="brocade:fabricos"
("web management" OR "httpd" OR "apache")
("failed to start" OR "unable to start" OR "configuration" OR "bring-up" OR "re-initialization")
| stats count min(_time) as first_seen max(_time) as last_seen by host, message
| where count > 2
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="brocade,fabricos,">
  <rule id="202687661" level="10">
    <decoded_as>json</decoded_as>
    <field name="service">httpd|apache|web management</field>
    <match>failed to start|unable to start|bring-up|configuration error</match>
    <description>CVE-2026-87661: Brocade Fabric OS web management service failed to start - possible persistent DoS</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_87661,availability_dos,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version package data is available in the provided intelligence. The guidance below is defensive and based on the described vulnerability class; it should be validated against vendor documentation when available.

1. Immediate mitigations

   • Restrict network access to the Brocade Fabric OS web management interface to trusted administrative networks. Because exploitation requires an attacker "capable of corrupting the configuration structure," reducing who can reach and influence administrative interfaces directly lowers exposure.
   • Maintain and verify integrity of the web management service configuration. Keep known-good backups of the Apache-backed configuration so a corrupted structure can be restored rather than rediscovered during bring-up.
   • Monitor service startup/re-initialization events and alert on repeated failures (see Detection Guidance).
   • Where operationally feasible, rely on an alternative, independently maintained management path while the web interface is degraded.

2. Patch / upgrade steps

   • There is currently no confirmed patch per the tracked sources (0/4). Monitor Brocade security advisories for a fixed Fabric OS release and apply it as soon as available.
   • If a fixed version is published, upgrade all affected instances: those before 9.2.2d and those in the 10.0.0 through 10.0.0a1 range.
   • After upgrade, validate that the web management service starts cleanly through a normal setup/re-initialization cycle.

3. Long-term hardening

   • Treat service configuration ingestion as a trust boundary: require structural validation, integrity checking, and rollback-on-failure for configuration consumed at service setup.
   • Enforce strict access control and change auditing on web management interfaces and their configuration.
   • Add continuous configuration-integrity monitoring so corrupted structures are detected before they cause a bring-up failure.
   • Maintain tested recovery procedures so persistent service failures can be remediated without relying on the failed service itself.

References

• NVD — CVE-2026-87661: https://nvd.nist.gov/vuln/detail/CVE-2026-87661
• MITRE CWE-93 (Improper Neutralization of CRLF Sequences / injection through control structure): https://cwe.mitre.org/data/definitions/93.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Brocade (Broadcom) Fabric OS Security Advisories: https://www.broadcom.com/support/fibre-channel-networking/security-advisories
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor campaign data and exploit-in-the-wild evidence: none reported. CVE-2026-87661 is not listed in CISA KEV, no public PoC or exploit code is available, and the EPSS score is 0.00163 (5.1% percentile), indicating a low current probability of exploitation activity.