CVE-2026-87664

Executive Summary

CVE-2026-87664 is an authentication bypass vulnerability (CWE-306, Missing Authentication for Critical Function) in the web management daemon of Brocade Fabric OS. During processing of local inter-process communication (IPC) storage callbacks, the service accepts and registers session structures carrying administrative role permissions, user identifiers, and authorization flags without validating the identity or authenticity of the sending process. An unauthenticated attacker who can reach the affected IPC path can forge an administrative session and obtain elevated privileges on the web management interface of the targeted switch, with no legitimate authentication required.

Technical Analysis

Brocade Fabric OS (FOS) is the embedded operating system used across Brocade SAN switches and directors, including the Fibre Channel fabric infrastructure that underpins enterprise storage area networks. The product ships a web management daemon that exposes a browser-based administrative interface ("Web Tools") on the switch, used by storage and network administrators to manage zoning, port configuration, fabric services, and security settings.

The vulnerability lies in the local IPC layer rather than in the web-facing authentication logic itself. According to the NVD description, when the web management daemon processes local inter-process communication storage callbacks, it "accepts and registers session structures including administrative role permissions, user identifiers, and authorization flags—without verifying the identity or authenticity of the sending process." In other words, the authorization decision for a management session is delegated to data supplied over a local IPC channel, and the daemon trusts that data at face value. Because no authentication or integrity check is applied to the sender or to the session structure it delivers, any process capable of writing to that IPC path—or any attacker able to reach it through a chain of prior access—can construct a session object that asserts administrative role membership and bypass the web management authentication flow entirely.

The root cause maps to CWE-306, Missing Authentication for Critical Function: a security-critical operation (establishing an authenticated administrative session on the web management interface) is performed without any proof of identity. This differs from a classic credential-stuffing or session-hijacking issue because the attacker does not need to steal a valid session or guess a password—the daemon will create the privileged session on request.

The affected versions are Brocade Fabric OS 9.2.2d and 10.0.0 through 10.0.0a1. This range spans the 9.2.x maintenance line and the early 10.0.0 branch, meaning both generally available and early-access builds are exposed. No CVSS vector was published by the vendor or NVD at the time of reporting, and no patch, workaround, PoC, or Nuclei template is currently available from tracked sources. EPSS is 0.00123 (approximately the 1.8th percentile of exploited CVEs), indicating that as of this writing, exploitation in the wild is not yet observed at scale—though EPSS is a probabilistic forward-looking score and low values do not guarantee safety, particularly for high-value SAN infrastructure.

As a network-facing management service normally bound to a switch management IP (often an out-of-band management interface), the attack surface requires IP reachability to the switch management plane. In many enterprise deployments, switch management interfaces sit on a dedicated management VLAN reachable from administrative jump hosts, which constrains the attacker's initial position; however, flat or poorly segmented networks, VPN concentrators, and misconfigured management planes frequently expose such interfaces more broadly, and the vulnerability is especially dangerous in any environment where an attacker has already established a foothold on a host that can reach the IPC channel or the daemon.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is available for CVE-2026-87664. The attack chain below is inferred strictly from the vulnerability class (CWE-306, missing authentication on a session-establishment function) and the NVD description; no function names, endpoints, or parameters are asserted beyond what the description provides.

1. Reconnaissance / target identification. The attacker identifies reachable Brocade Fabric OS switches running affected versions (9.2.2d, or 10.0.0 through 10.0.0a1). Because the web management daemon typically listens on HTTPS, scanning for the switch management interface and fingerprinting the FOS web management service are the discovery steps. Public scanning data (see SHODAN_DORKS) can surface Fabric OS management interfaces on internet-exposed or adjacent networks. Exact version identification may be obtainable from the management interface itself or from banner/response fingerprints, since the affected range is specified by version.

2. Triggering the specific flaw class. The attacker targets the local IPC storage callback handling path of the web management daemon. Instead of authenticating through the web UI, the attacker delivers (or causes to be delivered) a crafted session structure over the IPC channel. Per the NVD description, this structure includes administrative role permissions, user identifiers, and authorization flags. The critical defect is that the daemon does not verify the identity or authenticity of the sending process before registering the session. At the vulnerability-class level, the attacker is therefore supplying a forged authorization decision where the daemon expected a trusted internal message.

3. Payload / execution method (class level). The payload is a forged session-registration message containing administrative role permissions and authorization flags. Because the daemon accepts it without authenticity checks, registration of the session itself is the "exploit." The attacker does not need valid credentials; the forged structure asserts privilege directly. The precise wire format, callback names, and IPC transport are not disclosed in the available intelligence, and no exploit code exists publicly. In practice, an attacker with code execution on the switch's local IPC-adjacent context, or one who can reach the IPC path through an existing foothold, would interact with the callback interface in the format the daemon expects; an attacker without local access would first need either management-plane access sufficient to invoke the callback path or a separate vulnerability that provides such access. This nuance is important and should not be glossed over: while the flaw is a complete authentication bypass for the session-establishment function, the delivery precondition (reachability of the local IPC callback) bounds the realistic exploitation profile.

4. Post-exploitation impact. Successful registration of the forged administrative session grants elevated privileges on the web management interface. From there, the attacker can exercise administrative control over the switch—which in a SAN context can extend to fabric configuration (zoning), port enable/disable, and security settings depending on the permissions asserted. The blast radius is not limited to a single device: Brocade switches are fabric members, and administrative control of one switch can be leveraged to disrupt, observe, or reconfigure interconnected fabrics, degrading availability and integrity of storage access for hosts and arrays that depend on them.

Impact Assessment

CWE-306 combined with the NVD description supports high impact across confidentiality, integrity, and availability on the affected component. No CVSS vector was published (CVSS: N/A), so the vector in the metadata reflects a standard unauthenticated network-vector assessment of an authentication bypass (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and should be treated as an analytical estimate, not a vendor-published score.

• Confidentiality: An attacker with an administrative management session can view fabric topology, zoning configuration, port and device inventory, and any management data the interface exposes—information valuable for mapping a storage network ahead of a broader intrusion.
• Integrity: Administrative access allows modification of switch and fabric configuration. In a SAN, unauthorized configuration changes can redirect, partition, or disable storage paths, potentially enabling data-in-path manipulation or denial of service against critical workloads.
• Availability: Administrative control of a fabric switch is a high-leverage denial-of-service position. Misconfiguration or active disruption of a core SAN switch can take down storage access for many downstream hosts and applications, with potential cascading impact on databases, virtualization clusters, and backup infrastructure.

Blast radius: The directly affected assets are Brocade Fabric OS switches and directors running the specified versions. Because these devices form the storage fabric backbone, the effective blast radius in a successful exploitation can include every host, hypervisor, and application dependent on the affected fabric. Organizations with large Fibre Channel estates—financial services, healthcare, government, and any enterprise with tier-1 storage—should treat this as a high-priority exposure despite the low current EPSS score. The combination of network-reachable management interface and a complete authorization bypass is a serious risk for any environment that has not yet patched (and no patch exists).

Detection Guidance

Sigma Rule

title: Brocade Fabric OS Web Management Session Forgery via IPC Callback (CVE-2026-87664)
id: 9c1f4a2e-7b3d-4e6a-9f21-8d5c0a1b2e3f
status: experimental
description: Detects anomalous administrative session establishment on Brocade Fabric OS web management daemon without a corresponding authentication event, indicative of IPC session context forgery per CVE-2026-87664.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87664
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1190
  - cve.2026.87664
logsource:
  category: application
  product: brocade_fabric_os
detection:
  selection_session:
    event_type: 'session_register'
  selection_role:
    role: 'admin'
  selection_no_auth:
    - authentication_result: 'absent'
    - auth_source: 'ipc'
  condition: selection_session and selection_role and selection_no_auth
fields:
  - user_identifier
  - role
  - authorization_flags
  - source_process
falsepositives:
  - Legitimate internal service session registration during maintenance windows
level: high

YARA Rule

rule CVE_2026_87664_Brocade_FOS_Session_Forgery
{
    meta:
        description = "Detects forged administrative session structures referenced in CVE-2026-87664 IPC callback abuse on Brocade Fabric OS"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87664"
        date = "2026-01-01"
        severity = "high"
    strings:
        $s1 = "session_register" ascii wide nocase
        $s2 = "authorization_flags" ascii wide nocase
        $s3 = "admin_role" ascii wide nocase
        $s4 = "ipc_storage_callback" ascii wide nocase
        $s5 = "web_management" ascii wide nocase
    condition:
        uint32(0) == 0x464C457F and 2 of ($s*)
}

Suricata IDS Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET [443,80] (msg:"CVE-2026-87664 Brocade Fabric OS Web Management IPC Session Forgery Attempt"; flow:to_server,established; content:"session_register"; nocase; content:"authorization_flags"; nocase; content:"admin"; nocase; distance:0; within:512; classtype:attempted-admin; reference:cve,2026-87664; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-87664; sid:202687664; rev:1;)

Elastic Detection

sequence by host.id with maxspan=30s
  [any where event.category == "process" and process.name == "web_management_daemon"]
  [any where event.category == "authentication" and event.action == "session_register" and user.roles : "admin" and not event.outcome == "success"]

Splunk SPL Query

index=brocade_fos sourcetype=fabricos_webmgmt (event_type="session_register" OR callback="ipc_storage")
| where role="admin" AND (auth_source="ipc" OR isnull(authentication_result))
| stats count min(_time) as first_seen max(_time) as last_seen values(user_identifier) as users values(authorization_flags) as flags by host, src_ip, role
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="brocade_fabric_os,cve_2026_87664,">
  <rule id="100764" level="12">
    <decoded_as>json</decoded_as>
    <field name="event_type">session_register</field>
    <field name="role">admin</field>
    <field name="auth_source">ipc</field>
    <description>CVE-2026-87664: Possible Brocade Fabric OS administrative session forgery via IPC callback - admin session registered without authentication</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>authentication_bypass,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations. Restrict reachability to the Brocade Fabric OS web management interface to a dedicated, tightly controlled management VLAN or out-of-band management network; block management-plane access from user VLANs, WAN, and the internet. Terminate management sessions only from trusted administrative jump hosts with strong authentication (MFA on the jump layer). Harden fabric-side access: enforce strict administrative RBAC, audit for unknown admin accounts, and reduce the number of accounts with full fabric-administrator privileges. Because the flaw requires the forged IPC session structure to reach the daemon's callback processing path, isolating the management plane and monitoring for anomalous session registrations are the primary interim controls. Where feasible, disable unused web management services and prefer authenticated, out-of-band CLI management from a hardened jump host while awaiting a vendor fix.

2. Patch / upgrade steps. No patch is currently available from tracked sources; the product is considered unpatched. Brocade Fabric OS administrators should monitor Broadcom/Brocade security advisories and product downloads for a FOS release that addresses the affected versions (9.2.2d, 10.0.0 through 10.0.0a1). When a fixed firmware is released, plan maintenance-window upgrades with appropriate fabric-change procedures (non-disruptive upgrade where supported, staged per-fabric), validating zoning and fabric stability afterward. Until then, treat all affected switches as exposed.

3. Long-term hardening. Segment the SAN management plane from general-purpose networks and require authenticated, logged administrative access with MFA at the access layer. Enforce least privilege on switch administration and regularly review administrative accounts and authorization flags. Monitor the management interface for unexpected admin sessions and correlate switch session logs with authentication events. Maintain an inventory and version-tracking process for Fabric OS firmware so that future advisories can be triaged quickly, and include SAN switches in vulnerability management and threat-hunting scope, which is often overlooked relative to server and endpoint estates.

References

• NVD — CVE-2026-87664: https://nvd.nist.gov/vuln/detail/CVE-2026-87664
• MITRE CWE-306 — Missing Authentication for Critical Function: https://cwe.mitre.org/data/definitions/306.html
• Broadcom/Brocade Security Advisories (vendor advisory portal for Fabric OS): https://www.broadcom.com/support/fibre-channel-networking/security-advisories
• EPSS Score for CVE-2026-87664 (0.00123, ~1.8th percentile): https://api.first.org/data/v1/epss?cve=CVE-2026-87664
• CISA Known Exploited Vulnerabilities Catalog (CVE not listed as of reporting): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public PoC, exploit code, Nuclei template, or evidence of exploit-in-the-wild campaigns or named threat actor activity is associated with CVE-2026-87664 in the available intelligence at the time of writing.