CVE Feed

    Dashboard / CVE / CVE-2026-87681

    CVE-2026-87681

    An Access Control Bypass vulnerability exists in the Role-Based Access Control (RBAC) validation engine of Brocade Fabric OS versions before 10.0.1. When processing certain management protocol operations, the RBAC engine incorrectly categorizes non-standard action opcodes during permission checks. This allows authenticated users with read-only management privileges to bypass access controls and execute restricted administrative operations.

    Published:Oct 8, 2026
    Last Modified:Oct 13, 2026
    EPS:Oct 8, 2026
    EPSS Score:0.00172
    CVSS Score:6.3

    Affected Products

    Vendor
    Broadcom
    Product
    Fabric Operating System
    Vendor
    Brocade
    Product
    Fabric Os

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-269 Improper Privilege Management

    Related CVEs

    CVE-2026-94585 (CVSS 7.7) — An authentication bypass vulnerability exists in the web management interface of Brocade Fabric OS versions be…
    CVE-2026-94587 (CVSS 6.9) — A buffer overflow vulnerability exists in the WebTools administrative interface handling configuration downloa…
    CVE-2026-94579 (CVSS 5.4) — An OS command injection vulnerability exists in the PAM (Pluggable Authentication Module) session cleanup rout…
    CVE-2026-94576 (CVSS 5.9) — An authentication logic and privilege escalation vulnerability exists in the account management interface of B…
    CVE-2026-87661 (CVSS 6.8) — Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 directly accepts Apache configuration fil…
    CVE-2026-87677 (CVSS 5.4) — An OS command injection vulnerability exists in the account management subsystem of Brocade Fabric OS versions…
    CVE-2026-94586 (CVSS 8.5) — A command injection vulnerability exists in the WebTools administrative interface handling configuration downl…
    CVE-2026-94581 (CVSS 8.5) — An OS command injection vulnerability exists in the REST API management interface of Brocade Fabric OS version…
    CVE-2026-94577 (CVSS 7.3) — A privilege escalation vulnerability exists in the internal Command-Line Interface (CLI) authorization handlin…
    CVE-2026-87664 (CVSS 8.5) — A session context forgery vulnerability exists in the web management daemon of Brocade Fabric OS versions 9.2.…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High