CVE-2026-87667 Brocade CVE debrief

Who should care

System administrators and security teams responsible for Brocade Fabric OS systems, particularly those with low-privilege administrative access, should assess exposure and prioritize patching.

Why it matters

CVE-2026-87667 is a high-severity vulnerability in Brocade Fabric OS that allows authenticated users to read arbitrary files. System administrators and security teams should assess exposure, prioritize patching, and review configurations to prevent potential unauthorized access to sensitive information.

• Potential unauthorized access to sensitive configuration files
• Potential exposure of system password hashes and system secrets
• Requires verification of affected versions and remediation status
• Prioritize patching and configuration review for Fabric OS systems

Technical summary

The configuration management command-line utility in Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 fails to sanitize user-supplied search string options, allowing authenticated users with low-privilege administrative access to read arbitrary files on the local operating system. This vulnerability is a result of inadequate input validation and sanitization in the utility, which can be exploited to access sensitive configuration files, system password hashes, and system secrets. The vulnerability requires authentication but can lead to significant exposure if not properly addressed.

Defensive priority

High-priority patching and configuration review recommended

Recommended defensive actions

• Patch Brocade Fabric OS to version 9.2.2d or later
• Patch Brocade Fabric OS to version 10.0.0a2 or later
• Review and restrict access to configuration management command-line utility
• Monitor for suspicious activity on Fabric OS systems
• Conduct a thorough review of system configurations to identify potential exposure
• Verify the integrity of system password hashes and system secrets
• Implement compensating controls for exposed systems while remediation is scheduled

Evidence notes

The CVE description and source metadata provide details on the vulnerability and affected versions. The vulnerability is confirmed in Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. Evidence is limited to CVE details and source metadata; further verification is required to confirm affected deployments and validate vendor guidance. Defenders should verify the presence of affected versions in their environments and review configurations for potential exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.