CVE-2026-87663: CWE-290: Authentication Bypass by Spoofing in Brocade Fabric OS

CVE-2026-87663 is a vulnerability in Brocade Fabric OS's inter-switch remote execution service affecting versions prior to 9.2.2d and 10.0.0 through 10.0.0a1. The vulnerability arises because the receiving switch processes remote command execution IPC frames at an elevated privilege level without properly verifying transmitted parameters. This improper verification enables an attacker with access to a single fabric-connected switch to bypass authentication and perform command injection, leading to privilege escalation and arbitrary root command execution either locally or across other fabric members with remote execution enabled.

An attacker with access to a fabric-connected switch can bypass authentication controls and execute arbitrary commands with root privileges on the local switch or other managed fabric members. This can lead to full compromise of the affected switches within the fabric, potentially disrupting network operations or allowing further malicious activity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to fabric-connected switches and disable remote execution functionality where possible to reduce exposure.