CVE-2026-87671
Executive Summary
CVE-2026-87671 is an out-of-bounds read vulnerability (CWE-125) in the web management daemon of Brocade Fabric OS versions prior to 10.0.1. Unauthenticated remote attackers can trigger an invalid memory dereference by sending a single crafted HTTP request with extreme numerical values in URL query parameters, crashing the web management process and causing temporary management-plane disruption (Denial of Service). No public proof-of-concept, exploit code, or Nuclei template is currently available, and no patch evidence has been tracked from any source, leaving affected systems exposed.
This record — and 170,000+ others — are available via the ValtersIT API. One endpoint replaces five: NVD + GitHub CVE + CISA KEV + EPSS + Nuclei + Exploit-DB, unified.
No signup required
Technical Analysis
The vulnerability resides within the web management daemon that ships with Brocade Fabric OS. According to the NVD description, unauthenticated HTTP endpoints process specific URL query parameters without validating array index boundaries and without performing numerical range checks. When an attacker supplies extreme numerical values in the query string, the daemon uses these values as array indices or offsets, resulting in an out-of-bounds memory read. The invalid memory dereference that follows terminates the web management process.
This is a classic CWE-125 (Out-of-bounds Read) condition. The core defect is the absence of two complementary controls: (1) boundary validation on array index values and (2) numerical range checking on attacker-controlled integers parsed from the query string. Because the endpoints are unauthenticated, no credentials or session tokens are required to reach the vulnerable parsing logic.
The attack surface is the HTTP management interface exposed by Fabric OS. The description does not identify the specific daemon binary, endpoint path, parameter names, or whether the crash is deterministic or dependent on memory layout. No information is available regarding ASLR bypass, information disclosure through the out-of-bounds read, or whether the read can be escalated beyond denial of service. In the absence of a vendor advisory or CVE-specific technical write-up, the mechanism should be understood at the vulnerability-class level: untrusted numeric input flows into an indexing operation without sanitization, producing memory access outside the intended buffer.
It is important to note that out-of-bounds reads can, in some implementations, leak adjacent memory contents before crashing. The NVD description explicitly frames the outcome as a crash and temporary management-plane disruption, and does not claim confidentiality or integrity impact. Analysts should not assume data exfiltration potential without further evidence.
Exploitation Scenarios
No public PoC is available; the attack chain below is inferred from the vulnerability class and the NVD description.
Reconnaissance / target identification: An attacker scans for internet- or management-network-exposed Brocade Fabric OS web management interfaces. Fingerprinting relies on HTTP response banners, TLS certificate subject fields, or known static content referencing Fabric OS. Targets of interest are those running a version below 10.0.1.
Triggering the flaw: The attacker sends a single crafted HTTP request to an unauthenticated endpoint, embedding extreme numerical values in the query string. These values are passed to the daemon as array indices or numeric offsets. Because no boundary or range validation is performed, the resulting memory access falls outside the bounds of the intended buffer.
Execution method at the vulnerability-class level: This requires no authentication, no user interaction, and no multi-stage payload. The out-of-bounds read is triggered in the same request that delivers the malicious parameter value. The description states a single crafted HTTP request is sufficient.
Post-exploitation impact: The invalid memory dereference crashes the web management process. This produces a denial-of-service condition on the management plane and potential temporary disruption of management operations. The description does not indicate code execution, persistence, or lateral movement arising from this issue.
Because the description does not name specific endpoints or parameters, defenders should not build detections around fabricated paths. Instead, detection should key on anomalous numeric query values reaching the management interface, as illustrated in the detection section below.
Impact Assessment
The vulnerability is network-reachable (AV:N), requires no privileges (PR:N), no user interaction (UI:N), and is unauthenticated, which places the base severity in the High range when scored with standard CVSS 3.1 metrics (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The NVD entry does not publish a CVSS score, so the vector above is a standard-metric representation derived from the description, not a vendor-issued value.
Blast radius is limited to the availability of the web management daemon and, transitively, to management-plane operations that depend on it. Fabric OS powers SAN switches and directors in storage networks; loss of the management interface can impede provisioning, zoning changes, monitoring, and troubleshooting until the process recovers or the device is restarted. The EPSS score is 0.00225 (12.2nd percentile), indicating low predicted exploitation likelihood in the near term. The CVE is not listed in CISA KEV. There is no evidence of active exploitation in the wild.
Confidentiality and integrity impacts are not claimed by the description. The primary business impact is operational: management-plane unavailability in environments where SAN fabric administration is time-sensitive.
Detection Guidance
Sigma Rule
title: Brocade Fabric OS Web Management Out-of-Bounds Read Attempt
id: 8f3a1c2e-9b47-4d6e-a1f0-2c7d5e9b4a13
status: experimental
description: Detects HTTP requests to Brocade Fabric OS web management endpoints containing extreme numeric query parameter values indicative of CVE-2026-87671 exploitation attempts.
references:
- https://nvd.nist.gov/vuln/detail/CVE-2026-87671
author: valtersit.com
date: 2026/01/01
tags:
- attack.t1190
- cve.2026.87671
logsource:
category: webserver
detection:
selection_method:
cs-method:
- 'GET'
- 'POST'
selection_extreme_numeric:
cs-uri-query|re: '(?:^|&)[^=]+=(?:\d{10,}|-2147483648|2147483647|4294967295|18446744073709551615)'
selection_endpoint:
cs-uri-stem|contains:
- '/'
condition: selection_method and selection_extreme_numeric and selection_endpoint
falsepositives:
- Legitimate administrative automation using large numeric identifiers
- Benign monitoring systems passing high-precision timestamps
level: medium
YARA Rule
rule CVE_2026_87671_Brocade_FOS_OOB_Read
{
meta:
description = "Detects HTTP requests targeting Brocade Fabric OS web management with extreme numeric query values (CVE-2026-87671)"
author = "valtersit.com"
date = "2026-01-01"
reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87671"
severity = "medium"
strings:
$http_get = "GET /" ascii nocase
$http_post = "POST /" ascii nocase
$q = "?" ascii
$hdr = "Host:" ascii nocase
$brocade1 = "Brocade" ascii nocase
$brocade2 = "Fabric OS" ascii nocase
$big1 = "2147483647" ascii
$big2 = "4294967295" ascii
$big3 = "18446744073709551615" ascii
$neg1 = "-2147483648" ascii
condition:
($http_get or $http_post) and $q and $hdr and
any of ($big*) and
any of ($brocade*)
}
Suricata IDS Rule
alert http any any -> any any (msg:"CVE-2026-87671 Brocade Fabric OS Web Management Out-of-Bounds Read Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; pcre:"/(?:\?|&)[^=&]+=(?:2147483647|4294967295|18446744073709551615|-2147483648|[0-9]{12,})/"; http.header; content:"User-Agent"; nocase; reference:cve,2026-87671; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-87671; classtype:attempted-dos; sid:202687671; rev:1;)
Elastic Detection
network where
http.request.method in ("GET", "POST") and
http.request.uri : "*=*" and
(
http.request.uri : "*2147483647*" or
http.request.uri : "*4294967295*" or
http.request.uri : "*18446744073709551615*" or
http.request.uri : "*-2147483648*"
)
Splunk SPL Query
index=web OR index=proxy
| eval uri = coalesce(uri, url, cs_uri_stem)
| eval query = coalesce(uri_query, cs_uri_query, query_string)
| where match(query, "(?:^|&)[^=&]+=(?:2147483647|4294967295|18446744073709551615|-2147483648|[0-9]{12,})")
| stats count min(_time) as first_seen max(_time) as last_seen values(src_ip) as source_ips values(uri) as target_uris by host, dest_ip
| where count >= 1
| sort - count
Wazuh OSSEC Rule
<group name="brocade,web,attack,">
<rule id="2026871" level="10">
<decoded_as>web-accesslog</decoded_as>
<url>\.(cgi|html|htm)</url>
<regex type="pcre2">(?:\?|&)[^=&]+=(?:2147483647|4294967295|18446744073709551615|-2147483648|[0-9]{12,})</regex>
<description>CVE-2026-87671: Brocade Fabric OS web management out-of-bounds read attempt detected</description>
<mitre>
<id>T1190</id>
</mitre>
<group>cve_2026_87671,pci_dss_6.5.2,</group>
</rule>
</group>
Mitigation & Patch Guidance
Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).
Immediate mitigations:
- Restrict network access to the Brocade Fabric OS web management interface using firewall rules, ACLs, or management VLAN segmentation. The vulnerable endpoints are unauthenticated, so authentication-based controls will not mitigate this issue on their own — network isolation is the primary compensating control.
- Disable the web management daemon if it is not operationally required, or disable unauthenticated HTTP endpoints where the platform permits configuration changes.
- Deploy the network detection signatures above (Suricata, Elastic, Splunk, Wazuh) to identify exploitation attempts in near real time and to measure exposure.
- Monitor management-plane availability and configure alerting on unexpected restarts or unavailability of the web management process.
Patch/upgrade steps:
- The NVD description states the issue affects versions "before 10.0.1," which implies 10.0.1 is the first fixed release. Upgrade to Brocade Fabric OS 10.0.1 or later via the vendor's supported upgrade path.
- No patch sources, vendor fix references, or workarounds have been tracked in the intelligence feed for this CVE. Until a vendor advisory is confirmed, validate the fix version against official Brocade documentation before relying on it.
- Maintain configuration backups and change-control records prior to firmware upgrades to allow rollback.
Long-term hardening:
- Adopt a patch management process with defined SLAs for network infrastructure firmware, particularly for SAN fabric components where maintenance windows are constrained.
- Enforce strict management-plane segmentation and zero-trust access for network device administration.
- Continuously ingest vendor security advisories and CVE feeds for Fabric OS and other fabric infrastructure.
- Perform periodic authenticated and unauthenticated scanning of management interfaces to identify exposed endpoints and version drift.
- Evaluate the availability of firmware versions that systematically validate numeric input and enforce array bounds as part of a broader secure development lifecycle review.
References
- NVD — CVE-2026-87671: https://nvd.nist.gov/vuln/detail/CVE-2026-87671
- CWE-125 — Out-of-bounds Read: https://cwe.mitre.org/data/definitions/125.html
- MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
- CISA Known Exploited Vulnerabilities Catalog (CVE-2026-87671 not listed as of report date): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- Brocade / Broadcom Fabric OS Security Advisories: https://www.broadcom.com/support/fibre-channel-networking/security-advisories
What is this? Security researchers use these exact search queries on Shodan.io (a search engine for internet-connected devices) to find vulnerable systems globally. You can copy these dorks to see if your organization's IP space is exposed.