CVE-2026-87687: CWE-88: Improper Neutralization of Argument Delimiters or Special Sequences in Commands in Brocade Fabric OS

CVE-2026-87687 describes an authorization and input validation vulnerability in Brocade Fabric OS affecting versions prior to 9.2.2d and versions 10.0.0 through 10.0.0a1. The flaw allows an authenticated user with limited privileges in one Virtual Fabric to craft requests containing arbitrary fabric identifiers, bypassing access controls to perform unauthorized operations and view configuration details in other Virtual Fabrics or tenants. This vulnerability stems from improper validation of fabric identifiers and insufficient authorization checks.

Exploitation of this vulnerability allows a restricted authenticated user to perform unauthorized cross-fabric operations and gain visibility into configuration details of Virtual Fabrics or tenants they should not access. This can lead to information disclosure and potential unauthorized configuration changes across isolated fabrics, undermining tenant isolation and security boundaries within the Brocade Fabric OS environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to authenticated users and monitor for suspicious cross-fabric requests. Do not rely on this vulnerability being mitigated without vendor confirmation.