CVE-2026-87678

Executive Summary

CVE-2026-87678 is an input validation and output encoding flaw in the web management interface of Brocade Fabric OS versions prior to 10.0.1. An authenticated administrator — or an attacker able to supply crafted Federated Authentication (FA) configuration files during an import routine — can inject arbitrary web server directives via the unsanitized Identity Provider (IdP) issuer parameter. Successful exploitation can deny service by preventing the web management daemon from starting, or potentially alter web server security controls.

Technical Analysis

The vulnerability resides in the handling of the Identity Provider (IdP) issuer parameter within the Federated Authentication (FA) configuration workflow of the Fabric OS web management interface. The NVD description classifies this as both an input validation and output encoding defect, mapped to CWE-93 (Improper Neutralization of CRLF Sequences, i.e., CRLF injection). The core issue is that the system fails to sanitize user-supplied input before it is incorporated into web server configuration directives.

In a Federated Authentication configuration, the IdP issuer parameter is a metadata field that identifies the token issuer for SAML or OIDC-style federation. Because this value is not neutralized before being written into web server directive context, an attacker who controls the value can break out of the intended data context and inject additional server directives. This is the classic CRLF-injection / directive-injection pattern: control characters or line terminators embedded in the parameter terminate the expected directive and start a new attacker-controlled one.

The attack surface is the web management interface of Fabric OS. Two distinct injection paths are described:

1. A direct path where an authenticated administrator supplies the malicious issuer parameter through the FA configuration UI.
2. An indirect path where an attacker supplies a crafted FA configuration file that is consumed during an import routine, meaning the malicious value is stored and later processed without sanitization.

The primary demonstrated impact is availability: injected directives can prevent the web management daemon from parsing its configuration, causing the daemon to fail to start — a denial of service against the management plane. The description also notes the potential to "alter web server security controls," implying that injected directives could weaken or modify security-relevant web server behavior. No privilege escalation, remote code execution, or data confidentiality impact is described. No public PoC, exploit code, or Nuclei template exists for this CVE.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-93 CRLF/directive injection) and the behaviors explicitly stated in the NVD description.

1. Reconnaissance / Target Identification. An attacker identifies a reachable Brocade Fabric OS web management interface running a version prior to 10.0.1. Because exploitation requires administrative access to the FA configuration (or the ability to deliver a configuration file to an import routine), the attacker first seeks valid administrative credentials or a foothold that permits configuration import — for example, through social engineering, credential reuse, or an existing insider position.

2. Triggering the Flaw. Once in the FA configuration interface, the attacker supplies a value for the Identity Provider (IdP) issuer parameter containing injected content — in this class, line terminators or directive-breaking sequences that cause the value to escape its intended context. In the alternate path, the attacker crafts an FA configuration file containing the malicious issuer value and induces the system to consume it through the import routine. In both cases the system fails to validate the input, so the malicious content is accepted.

3. Payload / Execution Method (class level). The injected content is written into web server directive context without output encoding. The web server daemon then processes the poisoned configuration, interpreting the injected material as additional directives. No specific directive names, file paths, or parameter names beyond the IdP issuer parameter are described, so the exact syntactic payload is not published.

4. Post-Exploitation Impact. On the next daemon start or configuration reload, the malformed directive set can prevent the web management daemon from starting, denying access to the management plane. Alternatively, injected directives that alter web server security controls may degrade protections on the management interface. The description does not indicate code execution or lateral movement arising directly from this flaw.

Given that an administrator is already required (or a config-import path reachable), the practical exploitation barrier is elevated; however, the config-import vector means the flaw can be weaponized through file delivery rather than authenticated UI interaction alone.

Impact Assessment

The primary impact is availability of the management plane. By preventing the web management daemon from starting, exploitation removes administrative web access to the switch/fabric — a serious operational problem in SAN environments where management availability is critical. The secondary impact is integrity of security controls: injected directives may weaken web server security settings, though the description does not specify the extent. Confidentiality impact is not indicated.

Using the projected CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H:

• Attack Vector (N): exploitable over the network via the web management interface.
• Attack Complexity (L): no specialized conditions beyond supplying a crafted parameter/file.
• Privileges Required (H): requires administrative access or the ability to deliver a config file to the import routine.
• User Interaction (N): none required beyond the administrative/config-import action.
• Scope (U): impact confined to the affected component.
• Confidentiality (N): no information disclosure described.
• Integrity (L): potential alteration of web server security controls.
• Availability (H): daemon can be prevented from starting.

Affected systems: Brocade Fabric OS deployments running versions before 10.0.1 that expose the web management interface with Federated Authentication enabled or configurable. Blast radius is limited to the managed fabric node(s) where the malicious FA configuration is applied; however, loss of the management daemon can impede incident response and fabric administration. CVSS score and vector are not provided by NVD (listed as N/A), and the vector above is an analyst projection consistent with the described impact.

Detection Guidance

Sigma Rule

title: Brocade Fabric OS Federated Authentication IdP Issuer Parameter Injection (CVE-2026-87678)
id: 4e2c9f1a-8767-4b2d-9a3e-cve202687678
status: experimental
description: Detects attempts to inject web server directives via the Federated Authentication IdP issuer parameter in Brocade Fabric OS web management interface.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87678
author: Valters IT Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
  product: brocade
detection:
  selection_method:
    http.method:
      - POST
      - PUT
  selection_endpoint:
    http.url|contains:
      - 'federated'
      - 'idp'
      - 'issuer'
      - 'auth/config'
  selection_payload:
    http.body|contains:
      - '%0d%0a'
      - '%0a'
      - '%0d'
      - '\r\n'
      - "\n"
  condition: selection_method and selection_endpoint and selection_payload
fields:
  - c-ip
  - cs-username
  - cs-uri
  - cs-method
falsepositives:
  - Legitimate configuration with newline characters in issuer metadata (rare)
level: high

YARA Rule

rule CVE_2026_87678_Brocade_FA_IdP_Issuer_Injection
{
    meta:
        description = "Detects injection attempts targeting the Federated Authentication IdP issuer parameter in Brocade Fabric OS (CVE-2026-87678)"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87678"
        date = "2026-01-01"
        severity = "high"

    strings:
        $idp_issuer = "issuer" ascii nocase
        $fa_keyword1 = "Federated" ascii nocase
        $fa_keyword2 = "Identity Provider" ascii nocase
        $crlf1 = "\r\n" ascii
        $crlf2 = "%0d%0a" ascii nocase
        $crlf3 = "%0a" ascii nocase

    condition:
        filesize < 1MB and
        (($fa_keyword1 or $fa_keyword2) and $idp_issuer) and
        any of ($crlf*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-87678 Brocade Fabric OS Federated Authentication IdP Issuer CRLF Injection Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"federated"; nocase; http.uri; content:"issuer"; nocase; http.client_body; content:"%0d%0a"; nocase; reference:cve,2026-87678; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-87678; classtype:attempted-admin; sid:202687678; rev:1;)

Elastic Detection

sequence by user.name with maxspan=5m
  [ network where network.protocol == "http" and
      http.request.method in ("POST", "PUT") and
      /* endpoint related to federated authentication config */
      (url.path : "*federated*" or url.path : "*issuer*" or url.path : "*idp*") ]
  [ network where network.protocol == "http" and
      http.request.body : ("*%0d%0a*" or "*%0a*" or "*%0d*") and
      (url.path : "*federated*" or url.path : "*issuer*" or url.path : "*idp*") ]

Splunk SPL Query

index=web OR index=proxy sourcetype=*access* OR sourcetype=*http*
(method=POST OR method=PUT)
(uri_path=*federated* OR uri_path=*issuer* OR uri_path=*idp* OR uri_query=*issuer*)
| eval payload=coalesce(request_body, form_data, uri_query, "")
| where match(payload, "(?i)(%0d%0a|%0d|%0a|\r\n)")
| stats count min(_time) as firstSeen max(_time) as lastSeen by src_ip, dest_host, uri_path, user
| convert ctime(firstSeen) ctime(lastSeen)
| sort - count

Wazuh OSSEC Rule

<group name="brocade,web,">
  <rule id="2026876" level="12">
    <if_sid>31100,31101,31108</if_sid>
    <match>CVE-2026-87678|federated|issuer</match>
    <regex>%0d%0a|%0a|%0d|\\r\\n</regex>
    <description>CVE-2026-87678: Brocade Fabric OS Federated Authentication IdP issuer parameter injection attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,web,brocade,</group>
  </rule>

  <rule id="2026877" level="13">
    <if_sid>2026876</if_sid>
    <match>POST|PUT</match>
    <description>CVE-2026-87678: Confirmed injection payload submitted to Brocade Fabric OS web management interface</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,web,brocade,critical,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations.

   • Restrict network access to the Fabric OS web management interface to trusted management networks only (firewall/ACL the HTTPS management port).
   • Where Federated Authentication is not required, disable FA configuration to remove the attack surface.
   • Enforce strict administrative access controls and audit administrative accounts; since exploitation requires admin access or config-file delivery, credential hygiene and import-routine access control are first-line defenses.
   • Validate and sanitize any FA configuration files before import; reject files containing control characters or line terminators in the IdP issuer field.
   • Monitor web management logs for anomalies and daemon restart failures, which may indicate injected directives.

2. Patch/upgrade steps.

   • Upgrade to Brocade Fabric OS 10.0.1 or later, which the NVD description identifies as the fixed version ("versions before 10.0.1" are affected). No vendor advisory or patch reference is currently tracked; verify availability directly with the vendor before scheduling maintenance.

3. Long-term hardening.

   • Apply input validation and context-appropriate output encoding to all configuration parameters that feed web server directives.
   • Adopt secure configuration import workflows with schema validation and allow-listing of expected FA parameter formats.
   • Segment management-plane access from data-plane and general user networks.
   • Maintain an inventory of management interfaces and promptly apply vendor firmware updates.

References

• NVD — CVE-2026-87678: https://nvd.nist.gov/vuln/detail/CVE-2026-87678
• CWE-93 — Improper Neutralization of CRLF Sequences ('CRLF Injection'): https://cwe.mitre.org/data/definitions/93.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Brocade / Broadcom Fabric OS security advisories portal: https://www.broadcom.com/support/fibre-channel-networking/security-advisories

Note: No threat actor campaigns or exploit-in-the-wild evidence are associated with this CVE. EPSS score is 0.00201 (9.2th percentile), indicating a low predicted likelihood of exploitation. CISA KEV status: NOT listed.