CVE-2026-87665

Executive Summary

CVE-2026-87665 is a stack-based buffer overflow (CWE-121) in the Internet Key Exchange version 2 (IKEv2) protocol handler of Brocade Fabric OS versions prior to 10.0.1. The flaw is triggered when an IKEv2 initial key exchange request carrying an oversized Nonce payload is processed on extension switches or blades that run IPsec-enabled Fibre Channel over IP (FCIP) circuits. An unauthenticated remote attacker can send a single crafted UDP packet to port 500, causing a data-plane process crash (denial of service) on the affected device.

Technical Analysis

The vulnerability resides in the IKEv2 protocol handler that terminates IPsec tunnels for FCIP traffic on Brocade extension platforms. IKEv2 is the negotiation protocol used to establish Security Associations (SAs) for the IPsec transport of FCIP circuits; it operates over UDP port 500 (and UDP 4500 for NAT-T, though the advisory specifically cites port 500). The flaw is classified as CWE-121, the stack-based buffer overflow variant, meaning the overflow occurs on a fixed-size stack buffer rather than on the heap.

The triggering vector per the NVD description is the Nonce payload within an initial IKE key exchange request (IKE_SA_INIT message exchange). In IKEv2, the initiator transmits a Nonce payload as part of IKE_SA_INIT, and the responder must copy the supplied nonce material into a working buffer for key derivation and for building the reply. The advisory states that an oversized Nonce payload overflows this stack-resident buffer because the handler fails to validate the length of the incoming Nonce against the size of its destination buffer before copying.

The relevant characteristics of this vulnerability class are:

• Attack surface: The IKEv2 responder path on IPsec-enabled FCIP extension switches or blades. The interface is reachable pre-authentication, since IKE_SA_INIT processing occurs before any authentication exchange completes — no credentials or established SA are required.
• Trigger condition: A single UDP datagram directed at port 500 containing a malformed IKE_SA_INIT request whose Nonce payload length exceeds the buffer allocated by the handler.
• Impact class: Memory corruption originating from an unchecked length/copy operation. The observable, stated outcome is a crash of the data-plane process, producing a denial-of-service condition on the affected device.
• CWE rationale: CWE-121 is assigned because the corrupted region is stack memory. The advisory does not state that attacker-controlled data is preserved past the overflow into a return address or function pointer, and no remote code execution is claimed. The described outcome is limited to process crash.

There is insufficient technical detail in the available description to specify the exact buffer size, the precise parser routine name, or the offset at which corruption occurs. Those implementation-level specifics are not published in the supplied CNA/NVD text and are intentionally not fabricated here. What can be stated with confidence is the vulnerability class (stack buffer overflow), the protocol component (IKEv2 handler), the message field implicated (Nonce payload), the transport (UDP port 500), and the consequence (data-plane process crash). These are the elements that drive detection and mitigation.

Affected platforms are extension switches or blades — hardware deployed specifically to extend Fibre Channel fabrics over IP WAN links — configured to carry IPsec-protected FCIP circuits. Devices that do not have IPsec-enabled FCIP circuits active are unlikely to expose the vulnerable responder path to untrusted networks, which narrows the realistically exposed population considerably.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available for this CVE; the attack chain below is inferred from the vulnerability class and the NVD description. It does not rely on any fabricated function names or endpoints.

1. Reconnaissance / target identification. The attacker identifies internet- or WAN-reachable Brocade extension switches/blades that terminate IPsec for FCIP. This is done by scanning for hosts responding on UDP port 500 (IKE). Shodan queries such as port:500 and vendor/product fingerprints for Brocade Fabric OS surfaces candidate devices, and any host that answers IKE_SA_INIT on 500 is a potential target. Because the vulnerable handler is pre-authentication, no credentials or prior SA are needed to reach the parsing code.

2. Triggering the flaw class. The attacker crafts a single UDP datagram to port 500 containing an IKEv2 initial request (IKE_SA_INIT) in which the Nonce payload is oversized relative to the buffer the handler uses. In a stack overflow of this class, the overflow occurs because the handler copies the length-declared Nonce data into a fixed-size stack buffer without first validating that the declared length fits. The malformed length/value combination is what crosses the trust boundary.

3. Payload / execution method. At the vulnerability-class level, the payload is simply an oversized Nonce field embedded in a syntactically plausible IKE_SA_INIT message. Because exploitation targets a pre-authentication parser, a single packet is sufficient to attempt the overflow — there is no multi-step authentication handshake required first. No attacker-controlled memory corruption objective beyond the crash is documented; per the advisory, successful exploitation results in a data-plane process crash.

4. Post-exploitation impact. The stated outcome is process crash on the data-plane, i.e., a denial-of-service condition affecting the device's forwarding/FCIP functionality. There is no documented evidence of code execution, persistence, or lateral movement associated with this CVE. Impact is availability-only, constrained to the affected extension switch/blade.

Impact Assessment

The defined impact is availability-only denial of service. Using the standard CVSS v3.1 base decomposition implied by the described characteristics: network attack vector (AV:N, the packet traverses UDP to port 500), low attack complexity (AC:L, single crafted packet), no privileges required (PR:N, pre-authentication parser), no user interaction (UI:N), scope unchanged (S:U, the crash is contained within the vulnerable component), no confidentiality or integrity impact (C:N/I:N), and high availability impact (A:H, data-plane process crash). This yields a base score of 7.5 (High). Note: the NVD record provides no CVSS score or vector; the value above is derived strictly from the attributes described and should be treated as an analytical estimate, not a vendor-published score.

Blast radius. Only Brocade Fabric OS extension switches or blades running versions older than 10.0.1, with IPsec-enabled FCIP circuits configured, and with the IKEv2 responder reachable by an untrusted network are at risk. A successful single-packet crash of the data-plane process disrupts FCIP transport, which can interrupt replication, backup, or remote-site fabric traffic carried across those WAN links. Because FCIP is commonly used for long-distance storage replication and site redundancy, a sustained DoS (repeated packets) against extension devices can degrade disaster-recovery paths.

Threat context. EPSS is 0.00849 (56.8th percentile), indicating a low near-term probability of exploitation in the wild. There is no CISA KEV listing, no public PoC, and no known exploit code. The realistic threat is from targeted availability attacks against exposed extension infrastructure rather than opportunistic mass exploitation.

Detection Guidance

Sigma Rule

title: Suspected IKEv2 Nonce Payload Buffer Overflow - Brocade Fabric OS (CVE-2026-87665)
id: 8f3c2a10-7b64-4e2d-9a11-1c2d3e4f5a60
status: experimental
description: Detects oversized/abnormal IKEv2 IKE_SA_INIT Nonce payloads or repeated IKE traffic directed at Brocade Fabric OS extension switches that may indicate exploitation attempts of CVE-2026-87665.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87665
author: valtersit.com
date: 2026/01/01
logsource:
  category: network_connection
  product: firewall
detection:
  selection_port:
    dst_port: 500
    protocol: udp
  selection_source:
    - src_ip|cidr: '0.0.0.0/0'
  filter_known_peers:
    src_ip:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection_port and selection_source and not filter_known_peers
falsepositives:
  - Legitimate IKEv2 peers contacting the responder from non-RFC1918 space
  - VPN/NAT-T infrastructure re-establishing SAs
level: medium
tags:
  - attack.t1190
  - cve.2026-87665

YARA Rule

rule CVE_2026_87665_IKEv2_Oversized_Nonce
{
    meta:
        description = "Detects IKEv2 IKE_SA_INIT packets carrying abnormally large Nonce payloads potentially triggering CVE-2026-87665 stack overflow in Brocade Fabric OS"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87665"
        cve = "CVE-2026-87665"

    strings:
        // IKEv2 IKE_SA_INIT: initiator SPI + responder SPIs, then version 0x20,
        // exchange type 0x22 (IKE_SA_INIT), flags 0x08/0x00, then payloads.
        $ike_hdr = { 00 00 00 00 00 00 00 00 20 22 08 }
        // IKEv2 Nonce payload type byte = 0x28
        $nonce_payload = { 28 }

    condition:
        // Match UDP/500 IKEv2 SA_INIT and presence of a Nonce payload marker.
        // Full length validation must be done by the caller; this is a surfacing rule.
        $ike_hdr at 0 and $nonce_payload
}

Suricata IDS Rule

alert udp any any -> any 500 ( \
  msg:"CVE-2026-87665 Brocade Fabric OS IKEv2 oversized Nonce potential stack overflow attempt"; \
  flow:to_server; \
  content:"|22|"; offset:17; depth:1; \
  content:"|28|"; within:512; \
  byte_test:2,>,1024,0,relative; \
  threshold:type both, track by_src, count 5, seconds 60; \
  classtype:attempted-dos; \
  sid:202687665; rev:1; \
  reference:cve,CVE-2026-87665; \
  reference:url,nvd.nist.gov/vuln/detail/CVE-2026-87665; \
  metadata:service ike; )

Elastic Detection

network where destination.port == 500 and network.transport == "udp"
  and not source.ip in ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16")
  and (network.bytes > 1024 or event.duration > 0)

Splunk SPL Query

index=network sourcetype=firewall OR sourcetype=zeek_conn
| where (dest_port==500 AND transport=="udp")
| where NOT cidrmatch("10.0.0.0/8", src_ip) AND NOT cidrmatch("172.16.0.0/12", src_ip) AND NOT cidrmatch("192.168.0.0/16", src_ip)
| stats count AS ike_attempts, sum(bytes_out) AS total_bytes, dc(dest_ip) AS targets BY src_ip
| where ike_attempts >= 5
| sort - ike_attempts
| table src_ip, targets, ike_attempts, total_bytes

Wazuh OSSEC Rule

<group name="brocade,ikev2,cve-2026-87665,">
  <rule id="2026876" level="10">
    <decoded_as>json</decoded_as>
    <field name="dst_port">500</field>
    <field name="protocol">udp</field>
    <description>CVE-2026-87665: Possible IKEv2 oversized Nonce buffer overflow attempt against Brocade Fabric OS on UDP/500</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attempted_dos,pci_dss_10.2.4,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1) Immediate mitigations (apply while no vendor hotfix is available):

• Restrict access to UDP port 500 so that only authorized, trusted IKE/FCEP peers can reach the extension switch or blade. Enforce this with network ACLs on upstream firewalls/routers, and explicitly deny IKE from any untrusted or internet-facing interface.
• Where operationally feasible, disable or reconfigure IPsec on FCIP circuits that terminate on an exposed interface, and migrate the untrusted segment behind a controlled gateway.
• Rate-limit and alert on inbound IKE (UDP/500) traffic to extension devices to blunt repeated-packet DoS attempts.
• Segment extension/FCIP infrastructure onto a dedicated, non-internet-reachable management/WAN security zone.

2) Patch / upgrade steps:

• The advisory states the fix is available in Brocade Fabric OS 10.0.1 and later. Upgrade affected extension switches and blades to 10.0.1 or the latest supported release.
• Because tracked patch sources returned no verifier evidence, confirm the specific fix release directly with Broadcom/Brocade support and validate against your exact platform model before scheduling the upgrade window.
• Follow vendor Fabric OS upgrade procedure (including any required intermediate versions). Plan for the FCIP data-path restart that a firmware upgrade entails.

3) Long-term hardening:

• Maintain a current inventory of extension switches/blades running IPsec-enabled FCIP and track their firmware baseline against vendor advisories.
• Apply deny-by-default ingress filtering at the WAN perimeter for IKE (UDP 500/4500); permit only known peer addresses.
• Monitor the EPSS/Kev status; given current EPSS (~0.85%) the near-term exploitation risk is low, but verify the exposure of any internet-reachable IKE responder regardless.
• Include IKE/FCIP devices in availability-focused monitoring so a data-plane crash is detected and responded to quickly.
• Where possible, terminate IPsec at a dedicated, patched security gateway rather than on the extension switch itself, reducing the exposed parser surface.

References

• NVD — CVE-2026-87665: https://nvd.nist.gov/vuln/detail/CVE-2026-87665
• CWE-121 Stack-based Buffer Overflow: https://cwe.mitre.org/data/definitions/121.html
• Brocade/Broadcom Fabric OS and FCIP documentation portal (vendor advisories): https://www.broadcom.com/support/fibre-channel-networking
• FIRST EPSS — CVE-2026-87665 scoring: https://api.first.org/data/v1/epss?cve=CVE-2026-87665
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

Threat actor / exploit-in-the-wild status: No CISA KEV listing, no public PoC, no exploit code, and no known threat-actor campaign were identified in the provided data. Detection content above is based on behavior derived from the vulnerability class (pre-authentication IKEv2 Nonce processing on UDP/500), not on any observed exploit sample.