CVE-2026-87681 Brocade CVE debrief

Who should care

System administrators and security teams responsible for Brocade Fabric OS management interfaces and access control configurations should assess exposure and verify management protocol operation restrictions.

Why it matters

CVE-2026-87681 allows authenticated users with read-only management privileges to bypass access controls in Brocade Fabric OS versions before 10.0.1. System administrators and security teams should assess exposure, verify management protocol operation restrictions, and consider upgrading to patched versions.

• Authenticated users with read-only privileges may bypass access controls and execute restricted administrative operations.
• Management protocol operation restrictions and access control configurations require verification.
• Access control lists and user role assignments need review and update.
• Consider upgrading to Brocade Fabric OS version 10.0.1 or later for patched versions.

Technical summary

An Access Control Bypass vulnerability exists in the Role-Based Access Control (RBAC) validation engine of Brocade Fabric OS versions before 10.0.1. When processing certain management protocol operations, the RBAC engine incorrectly categorizes non-standard action opcodes during permission checks. This allows authenticated users with read-only management privileges to bypass access controls and execute restricted administrative operations.

Defensive priority

Authenticated users with read-only management privileges may bypass access controls; assess exposure and verify management protocol operation restrictions.

Recommended defensive actions

• Assess exposure of Brocade Fabric OS management interfaces to authenticated users with read-only privileges.
• Verify management protocol operation restrictions and access control configurations.
• Review and update access control lists and user role assignments.
• Consider upgrading to Brocade Fabric OS version 10.0.1 or later.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE Program record and NIST NVD detail page provide official vulnerability metadata and assessment. A Brocade security advisory is also available. Evidence limits are based on CVE Program and NVD details. Confirmed affected scope and severity are based on vendor guidance. Management protocol operation restrictions and access control configurations require verification.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.