CVE Feed

    Dashboard / CVE / CVE-2026-87670

    CVE-2026-87670

    An authorization logic vulnerability exists in the Brocade Fabric OS versions before 10.0.1 REST API gateway. The internal gate guarding restricted management endpoints relies exclusively on client-controlled HTTP headers. An authenticated user with any valid REST session can spoof these headers to gain unauthorized access to internal management endpoints. This allows low-privilege users to view sensitive chassis metadata, hardware memory patrolling state, and firmware integrity audit logs.

    Published:Oct 8, 2026
    Last Modified:Oct 13, 2026
    EPS:Oct 8, 2026
    EPSS Score:0.00139
    CVSS Score:4.3

    Affected Products

    Vendor
    Broadcom
    Product
    Fabric Operating System
    Vendor
    Brocade
    Product
    Fabric Os

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-94585 (CVSS 7.7) — An authentication bypass vulnerability exists in the web management interface of Brocade Fabric OS versions be…
    CVE-2026-94587 (CVSS 6.9) — A buffer overflow vulnerability exists in the WebTools administrative interface handling configuration downloa…
    CVE-2026-94579 (CVSS 5.4) — An OS command injection vulnerability exists in the PAM (Pluggable Authentication Module) session cleanup rout…
    CVE-2026-94576 (CVSS 5.9) — An authentication logic and privilege escalation vulnerability exists in the account management interface of B…
    CVE-2026-87661 (CVSS 6.8) — Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 directly accepts Apache configuration fil…
    CVE-2026-87677 (CVSS 5.4) — An OS command injection vulnerability exists in the account management subsystem of Brocade Fabric OS versions…
    CVE-2026-94586 (CVSS 8.5) — A command injection vulnerability exists in the WebTools administrative interface handling configuration downl…
    CVE-2026-94581 (CVSS 8.5) — An OS command injection vulnerability exists in the REST API management interface of Brocade Fabric OS version…
    CVE-2026-94577 (CVSS 7.3) — A privilege escalation vulnerability exists in the internal Command-Line Interface (CLI) authorization handlin…
    CVE-2026-87664 (CVSS 8.5) — A session context forgery vulnerability exists in the web management daemon of Brocade Fabric OS versions 9.2.…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High