CVE-2026-87679

Executive Summary

CVE-2026-87679 is a heap-based buffer overflow (CWE-122) in Brocade Fabric OS versions prior to 10.0.1. When the product processes trunk configuration operations, it parses user-supplied list strings into dynamically allocated heap arrays without validating that the number of list elements stays within the maximum allowable limit. An authenticated administrator can send a crafted REST API request containing an excessive number of list delimiters, triggering heap corruption that can crash the service or, under the right conditions, allow arbitrary code execution. The vulnerability requires prior administrative authentication, limiting exploitation to trusted insiders or attackers who have already compromised admin credentials, but the resulting impact on SAN fabric availability and integrity is severe.

Technical Analysis

The flaw resides in the code path that handles trunk configuration via the Fabric OS REST API. Per the NVD description, the application parses user-supplied list strings into dynamically allocated heap arrays. The parser counts the elements from a delimited list string supplied by the caller and uses that count to size portions of a heap allocation. Because boundary checks on the maximum allowable number of elements are not enforced, a string containing an excessive number of delimiters produces more elements than the buffer was sized to hold. The result is a classic heap-based buffer overflow (CWE-122).

Key characteristics derived strictly from the available description:

• Root cause class: Missing bounds check on element count during parsing of delimited list strings (off-by-count / unbounded copy). CWE-122 heap-based buffer overflow.
• Attack surface: The management plane — specifically the REST API used to configure trunking. This is an authenticated interface, not an unauthenticated network-facing service.
• Trigger: A crafted REST API request whose trunk configuration list field contains a very large number of delimiters.
• Consequence of corruption: Adjacent heap metadata or adjacent objects are overwritten, which can produce a service crash (denial of service) or controlled memory corruption potentially leading to arbitrary code execution, depending on heap layout and attacker grooming.

The vulnerability sits at the dialectic between input validation and memory management: the parser trusts an attacker-influenced count to govern both allocation size and copy length, and because the two are derived inconsistently, the write overruns the allocation. There is no evidence in the provided data of a specific named function, API path, or parameter beyond the phrase "trunk configuration operations" and "REST API requests," so no such implementation identifiers are asserted here. No public proof-of-concept, Nuclei template, or exploit code is available; exploitation is inferred from the vulnerability class rather than observed tooling. EPSS is 0.00161 (≈4.7% percentile), indicating low near-term exploitation probability in the wild, consistent with the privileged access prerequisite.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred at the vulnerability-class level and strictly from the NVD description. No specific API endpoints, parameter names, or function names are invented.

1. Reconnaissance / target identification. An attacker identifies a reachable Brocade Fabric OS management interface running a version earlier than 10.0.1. Because the interface is authenticated, the attacker must already possess — or have obtained through separate means such as credential theft, default/weak credentials, or a prior foothold — administrative credentials.

2. Triggering the flaw. The attacker authenticates as an administrator and issues a crafted REST API request that invokes trunk configuration processing. The request carries a user-supplied list string packed with an excessive number of list delimiters. The parser expands this string into a heap array sized on an element assumption that the delimiter count violates, so the write overruns the allocated region (CWE-122).

3. Payload / execution method. At the vulnerability-class level, heap corruption is produced by the overlong element expansion. The attacker's control over delimiter placement and count governs the size and layout of the overwrite. Depending on how the corrupted heap is subsequently used (adjacent object pointers, metadata, or control structures), the outcome ranges from an immediate service crash to a corrupted control flow that can be steered toward arbitrary code execution.

4. Post-exploitation impact. Because the vulnerable component is the SAN fabric management plane, a successful compromise could enable service outage across managed switches, manipulation of trunk/ISL configuration, and — in the arbitrary-code-execution case — code running with the privileges of the management service. This is a fabric-wide blast radius given the administrative role.

Prerequisite summary: network reachability to the REST API plus valid administrative authentication. There is no evidence of this being exploitable pre-authentication.

Impact Assessment

The vulnerability is rated with high confidentiality, integrity, and availability impact (C:H/I:H/A:H) and requires high privileges (PR:H), with low attack complexity and no user interaction (AC:L/UI:N). Scope is unchanged (S:U). The combination is significant: once an attacker holds admin credentials, the exploitation is straightforward (low complexity, no user interaction) and the payload can affect memory integrity of a core management service.

• Confidentiality: Arbitrary code execution in the management context could expose fabric configuration data, credentials, and zoning information, and provide a pivot into managed switches.
• Integrity: Attackers could alter trunk/ISL configuration or, via code execution, modify switch behavior and persist malicious configuration.
• Availability: Even the crash-only outcome is severe — loss of the management service disrupts provisioning, monitoring, and fabric administration. Memory corruption in a SAN management process is a high-availability risk.

Affected systems: Brocade Fabric OS deployments earlier than 10.0.1 that expose the REST API used for trunk configuration. Blast radius: potentially the entire managed fabric, since trunk operations are fabric-topology–affecting and the compromised role is administrative. The privileged-access requirement reduces opportunistic mass exploitation but does not reduce severity for insider threat, credential-compromise, or post-foothold lateral-movement scenarios.

Detection Guidance

Sigma Rule

title: Brocade Fabric OS REST API Trunk Config Excessive List Delimiters (CVE-2026-87679)
id: b7c1e9a4-5f2d-4c8e-9a11-87f6b3c2d0aa
status: experimental
description: Detects REST API requests to Fabric OS trunk configuration with abnormally high list delimiter counts, consistent with heap overflow attempts (CWE-122).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87679
author: valtersit.com threat intelligence
date: 2026/01/01
logsource:
  category: webserver
  product: brocade_fabric_os
detection:
  selection_path:
    cs-uri-stem|contains:
      - 'trunk'
      - 'trunking'
  selection_delims:
    - cs-uri-query|re: '([,]{40,})'
    - cs-uri-query|re: '([;]{40,})'
    - cs-uri-query|re: '([|]{40,})'
  condition: selection_path and selection_delims
falsepositives:
  - Legitimate bulk trunk configuration scripts with very large trunk lists
level: high
tags:
  - attack.t1190
  - cwe.122

YARA Rule

rule CVE_2026_87679_Brocade_TrunkHeapOverflow
{
    meta:
        description = "Detects abnormally long delimited trunk list strings indicative of heap overflow attempts against Brocade Fabric OS (CVE-2026-87679)"
        author = "valtersit.com threat intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87679"
        cve = "CVE-2026-87679"
        date = "2026-01-01"
    strings:
        $trunk1 = "trunk" ascii nocase
        $trunk2 = "trunking" ascii nocase
        $delim_comma = /(,[^\x00]{0,16}){50,}/
        $delim_semi  = /(;[^\x00]{0,16}){50,}/
        $delim_pipe  = /(\|[^\x00]{0,16}){50,}/
    condition:
        (uint16(0) == 0x0a0d or true) and
        ($trunk1 or $trunk2) and
        any of ($delim_*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-87679 Brocade Fabric OS Trunk Config Heap Overflow Attempt"; flow:established,to_server; http.uri; content:"trunk"; nocase; http.uri; pcre:"/([;,|]){40,}/"; threshold:type limit, track by_src, count 1, seconds 60; classtype:attempted-admin; reference:cve,CVE-2026-87679; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-87679; sid:202687679; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [http where http.request.method in ("PUT","POST","PATCH")
     and http.request.method != null
     and wildcard(url.path, "*trunk*")]
  [http where wildcard(url.path, "*trunk*")
     and (
        regex(url.query, ".*(,){40,}.*")
        or regex(url.query, ".*(;){40,}.*")
        or regex(url.query, ".*(\\|){40,}.*")
     )]

Splunk SPL Query

index=web OR index=proxy
| eval uri=coalesce(uri_path, url, cs_uri_stem)
| where match(lower(uri), "trunk")
| rex field=uri max_match=0 "(?<delim>[,;|])"
| eval delim_count=mvcount(delim)
| where delim_count >= 40
| stats count min(_time) as first_seen max(_time) as last_seen values(src_ip) as sources values(dest) as targets by uri, delim_count, user
| where count >= 1
| sort - delim_count
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="web,brocade,cve-2026-87679,">
  <rule id="100679" level="12">
    <if_sid>31100</if_sid>
    <match>trunk</match>
    <regex>(,){40,}|(;){40,}|(\|){40,}</regex>
    <description>CVE-2026-87679: Possible Brocade Fabric OS trunk config heap overflow via excessive list delimiters in REST API request</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cwe_122,exploit_attempt,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 — UNPATCHED per tracked sources. Although the NVD description refers to "versions before 10.0.1," no vendor advisory, patch identifier, or fix commit is available in the provided data, so none is asserted. Do not treat any specific build as confirmed-fixed without verifying against Brocade's official security advisory.

1. Immediate mitigations

   • Restrict access to the Fabric OS REST API to trusted management subnets using firewall ACLs, management VLAN segmentation, and jump hosts.
   • Enforce least privilege: audit who holds the administrator role, disable idle accounts, and rotate administrative credentials — this vulnerability requires admin access to reach.
   • Where feasible, disable the REST API or trunk-configuration write operations if not operationally required.
   • Monitor and rate-limit REST API requests containing unusually long delimited list strings (see Detection Guidance) and alert on spikes in delimiter counts.

2. Patch / upgrade steps

   • Verify the current Fabric OS version across all switches, prioritizing any running a release earlier than 10.0.1.
   • Monitor Brocade (Broadcom) security advisories for a formal CVE-2026-87679 fix and the exact fixed release; apply it once published.
   • Until a vendor fix is confirmed, apply the network and privilege mitigations above and treat the REST API surface as high-risk.

3. Long-term hardening

   • Deploy runtime memory-integrity controls (e.g., heap hardening, ASLR, and compiler-level mitigations) where supported by the platform to raise the bar for heap-corruption exploitation.
   • Enforce strict server-side input validation on all list-parsing APIs, including hard maximum element counts and length caps — the missing control that underpins this CVE.
   • Integrate management-plane changes into CI/CD and change-management monitoring so suspicious trunk/ISL modifications trigger review.
   • Maintain continuous asset inventory of Fabric OS management endpoints so future advisories can be scoped instantly.

References

• NVD — CVE-2026-87679: https://nvd.nist.gov/vuln/detail/CVE-2026-87679
• CWE-122 (Heap-based Buffer Overflow): https://cwe.mitre.org/data/definitions/122.html
• MITRE ATT&CK T1190 (Exploit Public-Facing Application): https://attack.mitre.org/techniques/T1190/
• Brocade/Broadcom Fabric OS security advisories: https://www.broadcom.com/support/fibre-channel-networking/security-advisories
• EPSS score lookup for CVE-2026-87679: https://api.first.org/data/v1/epss?cve=CVE-2026-87679

Threat actor and exploit-in-the-wild status: no known campaigns, public PoC, or CISA KEV listing associated with CVE-2026-87679 at the time of writing; EPSS 0.00161 (≈4.7% percentile).