CVE-2026-87665 Brocade CVE debrief

Who should care

Brocade Fabric OS administrators, especially those with IPsec-enabled Fibre Channel over IP (FCIP) circuits, should assess exposure and prioritize patching to prevent potential denial of service (data-plane process crash).

Why it matters

Brocade Fabric OS versions before 10.0.1 are vulnerable to a stack-based buffer overflow, potentially leading to denial of service (data-plane process crash). Administrators should prioritize patching and verify IPsec-enabled Fibre Channel over IP (FCIP) circuits.

• Denial of service (data-plane process crash) may occur if the vulnerability is exploited
• Verification of patching and configuration is necessary to prevent exposure
• Monitoring for unusual UDP packet activity on Port 500 may help detect potential exploitation attempts

Technical summary

The vulnerability occurs in the Internet Key Exchange (IKEv2) protocol handler on Brocade Fabric OS versions before 10.0.1. An unauthenticated remote attacker can exploit this vulnerability by sending a single, specifically crafted UDP packet (Port 500) containing an oversized Nonce payload. This can lead to a denial of service (data-plane process crash) on extension switches or blades running IPsec-enabled Fibre Channel over IP (FCIP) circuits. Brocade Fabric OS administrators should assess exposure and prioritize patching to prevent potential denial of service.

Defensive priority

Medium-priority patching and verification recommended for Brocade Fabric OS versions before 10.0.1, especially for IPsec-enabled Fibre Channel over IP (FCIP) circuits.

Recommended defensive actions

• Patch Brocade Fabric OS to version 10.0.1 or later
• Verify IPsec-enabled Fibre Channel over IP (FCIP) circuits for potential exposure
• Monitor for unusual UDP packet activity on Port 500
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including its existence in Brocade Fabric OS versions before 10.0.1 and the potential for denial of service (data-plane process crash).

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.