CVE-2026-87674

Executive Summary

CVE-2026-87674 is a local privilege escalation vulnerability in the system logging daemon of Brocade Fabric OS affecting versions before 9.2.2d and releases 10.0.0 through 10.0.0a1. Insufficient access controls on internal inter-process communication (IPC) channels allow an unprivileged local user to submit malformed logging configurations that inject arbitrary directives, which are then executed with elevated privileges when the logging service reloads. Successful exploitation grants a low-privileged local actor root-equivalent control over a Fibre Channel SAN switch — a high-value, high-blast-radius target in enterprise storage networks.

Technical Analysis

Brocade Fabric OS (FOS) is the operating system running on Brocade Fibre Channel switches and directors, which form the fabric backbone of enterprise Storage Area Networks (SANs). The vulnerable component is the system logging daemon — the subsystem responsible for receiving, formatting, and writing log events generated by the switch's internal services.

The root cause per the NVD description is a combination of two weaknesses mapped to CWE-78 (Improper Neutralization of Special Elements used in an OS Command / OS Command Injection):

1. Insufficient access controls on internal IPC channels. The logging daemon exposes an inter-process communication interface used by other switch components to submit logging configuration. Access controls on that channel are inadequate, permitting a process or user operating at unprivileged privilege level to submit configuration data to the daemon.

2. Improper input sanitization during configuration file generation. When the daemon generates its configuration file, attacker-supplied directive values are not sanitized. An unprivileged local user can therefore inject arbitrary directives into the generated configuration. When the logging service reloads (whether on schedule, on admin action, or triggered as part of normal service cycling), those injected directives are processed with elevated privileges, resulting in local privilege escalation.

The exploitation primitive is therefore directive injection into a generated configuration consumed by a privileged service — a variant of configuration/command injection where the interpreter is the logging daemon's configuration parser rather than a shell directly. This is consistent with the CWE-78 classification: the injected directives permit execution of arbitrary commands or command-equivalent actions at the daemon's privilege level.

Attack surface summary:

The vulnerability is local-only: it requires an existing foothold on the switch — an unprivileged account, an exploited adjacent service, or a compromised management session. It is not remotely exploitable on its own. Unchanged scope indicates the exploitation occurs within the same security authority (the switch OS) and does not, by itself, cross a trust boundary beyond the switch.

The description does not disclose the specific IPC mechanism name, the configuration file path, the exact directive syntax, or the injection payload structure. No public proof-of-concept, Nuclei template, or exploit code is available. The attack chain below is therefore described at the vulnerability-class level consistent with the advisory.

Exploitation Scenarios

No public PoC is available; the attack chain is inferred from the vulnerability class and the NVD description.

Step 1 — Reconnaissance / target identification. An attacker with existing unprivileged local access to a Brocade Fabric OS switch (e.g., via a low-privilege CLI account, a compromised management session, or lateral movement from an adjacent host that has switch credentials) identifies the FOS version. Affected targets run versions before 9.2.2d or between 10.0.0 and 10.0.0a1. The attacker confirms access to the system logging subsystem or to a process capable of sending data to the logging daemon's IPC channel.

Step 2 — Triggering the flaw class. The attacker submits a malformed logging configuration through the insufficiently protected IPC channel. Because access controls on that channel do not sufficiently restrict the submitting principal, the unprivileged user's configuration input is accepted by the daemon. Because the daemon performs improper input sanitization during configuration file generation, the attacker's input is written into the generated configuration without neutralizing injected directives.

Step 3 — Payload / execution at the vulnerability-class level. The attacker embeds arbitrary directives in the configuration values. These are directives that, per CWE-78, result in OS command execution or its equivalent when interpreted by the privileged logging service. The payload does not require user interaction. Execution occurs when the logging service reloads its configuration — triggered either by the attacker if a reload path is reachable, by a scheduled reload, or by administrative action that cycles the service.

Step 4 — Post-exploitation impact. Because the directives execute with the elevated privileges of the logging daemon, the attacker gains privilege escalation from an unprivileged local user to the daemon's privilege level (root-equivalent on FOS). From that position, the attacker can read or alter switch configuration, manipulate fabric zoning and security policy, tamper with logs to remove evidence (a particularly severe outcome given the vulnerable component is the logging daemon itself), disable auditing, or pivot to other fabric members using the switch's trusted management relationships.

Constraints and uncertainties.

• The exact directive syntax and the IPC transport are not disclosed in the advisory and are not fabricated here.
• The trigger for reload (manual, scheduled, or crash-restart) is not specified.
• No exploit-in-the-wild, KEV listing, or public tooling is associated with this CVE as of this report.

Impact Assessment

• Confidentiality: High. Elevated access to the logging daemon and switch OS exposes configuration data, zoning databases, fabric topology, and potentially credentials and cryptographic material used for fabric authentication.
• Integrity: High. An attacker at the daemon's privilege level can modify switch and fabric configuration, including zoning, allowing unauthorized hosts to communicate across the SAN.
• Availability: High. SAN switches are single points of failure for storage access. Corruption of logging or switch configuration can disrupt storage connectivity for every host on the fabric, with potential for data-path outages.
• Attack complexity: Low; Privileges required: Low; User interaction: None. Once a local foothold exists, the technical barrier to exploitation is low.

Blast radius. Brocade switches commonly sit at the core of enterprise Fibre Channel SANs. Compromise of a single switch can affect the fabric it belongs to, and compromised management credentials on that switch can be used to reach other fabric members. Affected deployments include data centers, mainframe/enterprise storage environments, and any environment running FOS versions prior to 9.2.2d or 10.0.0–10.0.0a1.

EPSS. 0.00108 (~1.1% percentile) reflects low modeled exploitation likelihood at time of writing, consistent with a local-only vulnerability requiring existing access and with no public exploit code. This low EPSS should not be read as low business risk: for environments with multi-tenant or contractor access to switch management, or where unprivileged local accounts exist on FOS devices, the impact of successful exploitation is severe.

Detection Guidance

Detection focuses on logger-configuration manipulation, unexpected configuration-file generation events, and process execution originating from the logging daemon. Rules below are generic to the vulnerability class; tune file paths and process names to the environment.

Sigma Rule

title: Brocade Fabric OS Logging Daemon Directive Injection (CVE-2026-87674)
id: 7c9f1a2e-4b6d-4f0a-9e3c-1d2f8a5b6c70
status: experimental
description: Detects local attempts to inject directives into the system logging daemon configuration on Brocade Fabric OS via internal IPC, followed by a logging service reload.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87674
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1068
  - attack.privilege_escalation
  - cve.2026.87674
logsource:
  product: linux
  service: auditd
detection:
  selection_ipc_write:
    type: 'SYSCALL'
    syscall: 'write'
    exe|endswith:
      - '/logd'
      - '/syslogd'
      - '/rsyslogd'
  selection_suspicious_directive:
    data|contains:
      - '|'
      - '`'
      - '$('
      - ';'
      - '../'
  selection_reload:
    type: 'SYSCALL'
    exe|endswith:
      - '/logd'
      - '/syslogd'
      - '/rsyslogd'
    comm:
      - 'sh'
      - 'bash'
  condition: selection_ipc_write and selection_suspicious_directive or selection_reload
falsepositives:
  - Legitimate administrative configuration changes with special characters in log filters
level: medium

YARA Rule

rule CVE_2026_87674_Brocade_FOS_Logging_Directive_Injection
{
    meta:
        author = "valtersit.com"
        description = "Detects directive-injection payloads targeting the Brocade Fabric OS system logging daemon configuration"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87674"
        cve = "CVE-2026-87674"
        date = "2026-01-01"

    strings:
        $dir1 = "logging" nocase
        $dir2 = "syslog" nocase
        $inj1 = "$("
        $inj2 = "`"
        $inj3 = "| /"
        $inj4 = ";/"
        $inj5 = "../"
        $inj6 = "&& "
        $fos = "Fabric OS" nocase

    condition:
        uint32(0) != 0x7f454c46 and
        (any of ($dir1, $dir2)) and
        2 of ($inj*) and
        filesize < 512KB
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $HOME_NET any (msg:"CVE-2026-87674 Brocade Fabric OS Logging Daemon Directive Injection Attempt"; flow:established,to_server; content:"logging"; nocase; content:"|24 28|"; distance:0; within:64; content:"Fabric OS"; nocase; distance:0; within:512; sid:202687674; rev:1; metadata:created_at 2026_01_01, cve CVE_2026_87674, affected_product Brocade_Fabric_OS; classtype:attempted-user; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-87674;)

Note: because this is a local IPC vulnerability, network detection is applicable only to remote management sessions that carry crafted configuration payloads to the switch; intra-host IPC traffic may not traverse the monitored network path. Primarily an endpoint-side concern.

Elastic Detection

process where event.type in ("start", "process_started") and
  process.parent.name in ("logd", "syslogd", "rsyslogd") and
  process.name in ("sh", "bash", "dash") and
  process.args : ("*logging*", "*syslog*", "*config*")

Splunk SPL Query

index=main sourcetype=linux:audit OR sourcetype=brocade:fos
| search (syscall=write AND (exe="*/logd" OR exe="*/syslogd" OR exe="*/rsyslogd"))
    OR (event_type="logging_config_change" AND (data="*$(*" OR data="*`*" OR data="*;*" OR data="*|*"))
| stats count min(_time) as first_seen max(_time) as last_seen by host, user, exe, process_id
| where count > 0
| table first_seen, last_seen, host, user, exe, process_id, count

Wazuh OSSEC Rule

<group name="brocade,fabric_os,privilege_escalation,">
  <rule id="202687" level="12">
    <decoded_as>json</decoded_as>
    <field name="event_type">logging_config_change</field>
    <field name="source">ipc</field>
    <description>CVE-2026-87674: Suspicious logging configuration submitted via IPC on Brocade Fabric OS - possible privilege escalation attempt</description>
    <mitre>
      <id>T1068</id>
    </mitre>
    <group>privilege_escalation,</group>
  </rule>
  <rule id="202688" level="13" frequency="3" timeframe="120">
    <if_matched_sid>202687</if_matched_sid>
    <description>CVE-2026-87674: Repeated logging daemon configuration injections detected - likely active exploitation</description>
    <mitre>
      <id>T1068</id>
    </mitre>
  </rule>
  <rule id="202689" level="14">
    <decoded_as>json</decoded_as>
    <field name="process_parent">logd|syslogd|rsyslogd</field>
    <field name="process_name">sh|bash</field>
    <description>CVE-2026-87674: Shell spawned by logging daemon after configuration reload - possible code execution</description>
    <mitre>
      <id>T1068</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description references fixed version thresholds (9.2.2d and versions after 10.0.0a1), but no vendor advisory, OSV entry, CISA KEV listing, or other tracked source confirms a patch is available. Treat as unpatched until the vendor publishes a validated firmware release. No vendor fix or workaround text was provided in the source data.

1) Immediate mitigations (no patch available):

• Restrict local access. Eliminate or tightly control unprivileged local accounts on affected Fabric OS switches. Enforce least privilege and remove shared or default accounts.
• Harden management access. Restrict switch management interfaces (CLI, SSH, Web Tools) to dedicated, monitored management networks; require MFA at the access gateway where supported.
• Limit IPC exposure. If the platform permits, restrict which local principals can reach the logging daemon's IPC channel; audit any custom roles that grant logging-configuration privileges.
• Alert on reloads. Monitor for unexpected logging-service reloads and for shell/child processes spawned by the logging daemon.
• Integrity monitoring. Baseline switch configuration files and alert on unexpected changes to logging configuration or directive content.

2) Patch / upgrade steps (once a validated fix exists):

• Track Brocade/ Broadcom advisories for Fabric OS 9.2.2d and post-10.0.0a1 releases. Do not upgrade based on the NVD description alone — confirm the release notes and advisory explicitly address CVE-2026-87674.
• Stage firmware upgrades in a non-production fabric, validate zoning and management functionality, then roll to production with a documented rollback plan (SAN firmware changes require change-control and redundancy planning).
• After upgrade, verify the fixed version string on each switch and re-baseline configuration.

3) Long-term hardening:

• Enforce privilege separation and access control on all local IPC channels as a design requirement in switch firmware procurement.
• Implement input validation and output encoding/sanitization for any service that generates configuration files consumed by a privileged process.
• Adopt continuous firmware vulnerability management for SAN infrastructure, treating switches as tier-0 assets.
• Maintain network segmentation and out-of-band management for the storage control plane, with centralized, tamper-resistant logging off-switch (so that compromise of a switch's logging daemon cannot erase the audit trail).

References

• NVD — CVE-2026-87674: https://nvd.nist.gov/vuln/detail/CVE-2026-87674
• Brocade / Broadcom Fabric OS security advisories (vendor advisory portal — check for an advisory matching this CVE and affected versions 9.2.2d / 10.0.0a1): https://www.broadcom.com/support/fibre-channel-networking/security-advisories
• MITRE CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): https://cwe.mitre.org/data/definitions/78.html
• MITRE ATT&CK T1068 — Exploitation for Privilege Escalation: https://attack.mitre.org/techniques/T1068/
• FIRST EPSS — score lookup for CVE-2026-87674: https://api.first.org/data/v1/epss?cve=CVE-2026-87674

Exploit-in-the-wild / threat actor note: No CISA KEV listing, public PoC, Nuclei template, or exploit code is associated with CVE-2026-87674 as of this report. No known threat actor campaigns have been attributed. Exploitation likelihood is assessed as low (EPSS 0.00108) but impact is high for exposed, multi-account SAN environments.