CVE-2026-87687

Executive Summary

CVE-2026-87687 is a high-severity broken-authorization and improper input validation vulnerability affecting Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated but low-privileged user confined to one Virtual Fabric (VF) can submit a specially crafted request containing an arbitrary fabric identifier to bypass tenant/VF isolation and perform unauthorized cross-fabric operations, including reading configuration details belonging to VFs to which they were never granted access. The blast radius is any multi-tenant Fibre Channel SAN fabric running an affected Fabric OS release where Virtual Fabric segmentation is relied upon as a security boundary, making this a tenant-isolation break rather than a simple information disclosure.

Technical Analysis

CWE-88 (Improper Neutralization of Argument Delimiters in a Command) is used by NVD as the root-cause classification here, indicating that the software fails to correctly neutralize delimiter or identifier syntax within an argument before that argument is used in a privileged operation. Combined with the explicit description of an authorization failure, the mechanism is best understood as follows: an authenticated user operating with restricted privileges inside their own Virtual Fabric can craft a request that carries a fabric identifier value which is neither validated against the caller's effective fabric context nor normalized to the caller's own tenant. Because the identifier is not properly constrained (the delimiter/argument neutralization weakness) and because the backend does not re-verify that the caller's role actually entitles them to operate on the referenced fabric (the authorization weakness), the request is processed against a fabric outside the caller's sandbox.

The attack surface is the Fabric OS management plane reachable by an authenticated session — the same interface/API path through which legitimate per-fabric configuration operations are performed. The vulnerability is not a memory-safety issue and not remotely pre-auth: it requires valid credentials. Its severity derives from the privilege and scope escalation — a restricted tenant user crosses a trust boundary that administrators explicitly configured for multi-tenancy. Two distinct weaknesses are chained: (1) missing/incorrect validation that the fabric identifier argument belongs in the caller's authorized scope, and (2) failure to reject or clamp a caller-supplied identifier that references another tenant's fabric. The result is unauthorized read access to configuration data and the ability to invoke operations against foreign Virtual Fabrics.

No public proof-of-concept, Nuclei template, or exploit code is available. The precise request format, affected CLI/API verb, and parameter naming are not disclosed in the NVD description; any specific endpoint, function, or parameter name would be speculation and is intentionally omitted.

Exploitation Scenarios

The following chains are inferred strictly from the vulnerability class (broken authorization + argument-delimiter neutralization) and the facts stated in the NVD description. No public PoC exists; the exact request syntax is unknown.

1. Reconnaissance / target identification. The attacker must already possess valid Fabric OS credentials with restricted privileges scoped to a single Virtual Fabric — for example, a tenant operator or limited SAN-administration account in a shared multi-tenant fabric. The attacker enumerates their own fabric context and identifies that other Virtual Fabrics exist on the same physical switch/director (VF segmentation typically implies the presence of multiple logical fabrics sharing managed hardware).

2. Triggering the flaw class. From the authenticated management session, the attacker issues a legitimate per-fabric operation but substitutes or injects a fabric identifier referring to a different tenant's Virtual Fabric. Because the identifier argument is not correctly neutralized/validated (CWE-88) and because authorization is not re-bound to the caller's effective fabric, the backend processes the operation in the context of the attacker-supplied identifier rather than the caller's own VF.

3. Payload / execution (class level). The crafted request carries an arbitrary fabric identifier value in a field or argument that the backend trusts. The improper neutralization of argument delimiters can allow the supplied value to be interpreted as referencing a fabric outside the caller's authorized partition. This is an authorization/validation bypass — no memory corruption or code execution is involved. The exact parameter, delimiter, and transport (CLI command vs. REST/NETCONF/API call) are not specified in available data.

4. Post-exploitation impact. The attacker achieves cross-fabric operations: reading configuration details belonging to other tenants/Virtual Fabrics and performing actions to which they were not entitled. This violates the multi-tenant security boundary that VF segmentation is designed to enforce, potentially exposing zoning, device, and fabric topology data of other tenants, and enabling unauthorized state changes within foreign fabrics.

Impact Assessment

The vulnerability directly compromises the confidentiality and integrity of data managed by Brocade Fabric OS in multi-tenant deployments. Because VF isolation is a deliberate architectural control used to separate customers, departments, or managed-service tenants, successful exploitation breaks that tenant boundary — a scope change (S:C) in CVSS terms, since impact extends from the attacker's fabric to other fabrics. The realistic CVSS subscores are confidentiality:High (foreign configuration details are readable) and integrity:High (cross-fabric operations can modify state), with availability impact depending on which operations are reachable (not confirmed in available data, so treated conservatively). Preconditions are notable: the attacker must hold authenticated, restricted credentials and the environment must use Virtual Fabric segmentation. Single-fabric, single-tenant deployments are largely unaffected. Given the requirement for valid low-privilege credentials, EPSS is low (0.00190, 7.9th percentile), and there is no CISA KEV listing and no evidence of in-the-wild exploitation. Business impact centers on managed SAN service providers, large enterprises with tenant-partitioned fabrics, and any regulated environment where SAN configuration data is sensitive.

Detection Guidance

Sigma Rule

title: Brocade Fabric OS Cross-Virtual-Fabric Identifier Abuse (CVE-2026-87687)
id: 9f2a7c14-6b3e-4d21-8a55-2f0c1d7e4b90
status: experimental
description: Detects authenticated Fabric OS management requests that reference a Virtual Fabric identifier outside the caller's authorized scope, indicative of CVE-2026-87687.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87687
author: valtersit.com Threat Intelligence
date: 2026/01/01
logsource:
  product: brocade
  service: fabricos
detection:
  selection_action:
    action|contains:
      - 'fabricshow'
      - 'fabricconfig'
      - 'configshow'
      - 'switchshow'
  selection_cross:
    fabric_id|exists: true
  selection_denied:
    outcome: 'denied'
    reason|contains:
      - 'fabric'
      - 'authorization'
  condition: selection_action and selection_cross and selection_denied
falsepositives:
  - Legitimate administrative operations spanning authorized fabrics
  - Automated orchestration tools with explicit multi-fabric rights
level: high

YARA Rule

rule CVE_2026_87687_Brocade_FabricOS_CrossVF
{
    meta:
        author = "valtersit.com Threat Intelligence"
        description = "Detects artifacts referencing cross-Virtual-Fabric identifier abuse in Brocade Fabric OS (CVE-2026-87687)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87687"
        date = "2026-01-01"
        severity = "high"

    strings:
        $fos1 = "Fabric OS" ascii wide nocase
        $vf1  = "Virtual Fabric" ascii wide nocase
        $vf2  = "vFabric" ascii wide nocase
        $fabid = "fabricid" ascii wide nocase
        $fabname = "fabricname" ascii wide nocase
        $op1 = "fabricshow" ascii wide nocase
        $op2 = "configshow" ascii wide nocase

    condition:
        uint16(0) == 0x0a0d or filesize < 10MB
        and (1 of ($fos1, $vf1, $vf2))
        and (1 of ($fabid, $fabname))
        and (1 of ($op1, $op2))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-87687 Brocade Fabric OS Cross-Virtual-Fabric Identifier Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"fabric"; nocase; http.uri; content:"fabricid"; nocase; reference:cve,2026-87687; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-87687; classtype:attempted-user; sid:202687687; rev:1; metadata:created_at 2026_01_01, confidence Low;)

Elastic Detection

sequence by user.name, source.ip with maxspan=5m
  [authentication where event.action == "authentication_success" and event.outcome == "success"]
  [network where process.name in ("fabricshow","fabricconfig","configshow") and
   network.protocol in ("http","https","ssh","netconf") and
   network.direction == "egress"]
| where event.outcome == "failure" or
        network.bytes > 0 and user.roles in ("restricted","tenant","operator")

Splunk SPL Query

index=brocade sourcetype="fabricos:audit"
(("Fabric OS" OR "Virtual Fabric" OR "vFabric" OR "fabricid" OR "fabricname")
 AND (action="fabricshow" OR action="fabricconfig" OR action="configshow" OR action="switchshow"))
| eval suspicious=if((outcome="denied" OR match(reason,"(?i)fabric|authoriz")),1,0)
| stats count values(fabric_id) as target_fabrics values(reason) as reasons by user, src_ip, action
| where suspicious=1 OR count > 20
| sort - count

Wazuh OSSEC Rule

<group name="brocade,fabricos,">
  <rule id="202687" level="12">
    <decoded_as>json</decoded_as>
    <field name="product">Brocade Fabric OS</field>
    <field name="action" type="pcre2">fabricshow|fabricconfig|configshow|switchshow</field>
    <field name="fabric_id" type="pcre2">\d+</field>
    <field name="outcome" type="pcre2">denied|unauthorized|failed</field>
    <description>CVE-2026-87687: possible Brocade Fabric OS cross-Virtual-Fabric identifier abuse by $(user)</description>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

• Restrict management-plane access to Fabric OS switches/directors using network ACLs, dedicated out-of-band management VLANs, and jump hosts; ensure the management interface is not internet-reachable.
• Apply least privilege to Fabric OS accounts: eliminate shared accounts, enforce unique per-tenant credentials, and audit all accounts that carry any cross-fabric-capable role so that restricted users are confined to a single Virtual Fabric.
• Enforce strong MFA at the management gateway and monitor privileged/restricted session activity.
• Where Virtual Fabric isolation is security-critical and the affected release cannot be trusted, consider temporarily consolidating tenants onto physically separate switches/directors until a fix is available.

2. Patch / upgrade steps

• Check the Brocade (Broadcom) support portal for a Fabric OS advisory and fixed release addressing CVE-2026-87687. Per available data, versions before 9.2.2d and 10.0.0 through 10.0.0a1 are affected; treat any 10.0.0a1 build as pre-release/unsupported. No confirmed patch is available at time of writing — do not rely on a patch until the vendor confirms a fixed train.
• Until vendor confirmation, fingerprint every switch/director (version via version/management UI), inventory Virtual Fabric configurations, and track the vendor advisory for a fixed release.

3. Long-term hardening

• Treat VF segmentation as a functional partition, not a sole security boundary; layer RBAC, per-tenant accounts, and segmentation at the network layer.
• Deploy continuous configuration and audit-log monitoring for cross-fabric operations, and alert on any request referencing a fabric identifier outside the authenticated user's assigned scope.
• Maintain a software inventory and vulnerability-management cadence for SAN infrastructure equivalent to that used for servers and network devices, and subscribe to vendor security notifications.

References

1. NVD — CVE-2026-87687: https://nvd.nist.gov/vuln/detail/CVE-2026-87687
2. CWE-88 — Improper Neutralization of Argument Delimiters in a Command: https://cwe.mitre.org/data/definitions/88.html
3. MITRE ATT&CK — T1078 Valid Accounts: https://attack.mitre.org/techniques/T1078/
4. Brocade/Broadcom Fabric OS Security Advisories: https://docs.broadcom.com/ (vendor support portal — check for the CVE-specific advisory)
5. CISA Known Exploited Vulnerabilities Catalog (no entry for CVE-2026-87687 at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaign and no exploit-in-the-wild evidence are associated with CVE-2026-87687 in the data provided. EPSS is 0.00190 (7.9th percentile); CISA KEV: NO.