CVE-2026-87660: CWE-732: Incorrect Permission Assignment for Critical Resource in Brocade Fabric OS

This vulnerability (CWE-732) in Brocade Fabric OS arises from improper file permissions and missing authorization checks in the diagnostic kernel module subsystem. It affects versions prior to 9.2.2d and versions 10.0.0 through 10.0.0a1. An unprivileged local user can exploit this flaw to invoke privileged hardware tests, force system error conditions, reset hardware blades, or disrupt storage fabric operations, potentially impacting system stability and availability. The CVSS 4.0 score is 7.0, indicating high severity with attack vector local, low attack complexity, no user interaction, and high impact on integrity and availability.

An unprivileged local attacker can leverage this vulnerability to execute privileged hardware tests and cause system disruptions including forced error conditions and hardware resets. This can lead to denial of service or operational interruptions in storage fabric environments running affected Brocade Fabric OS versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to trusted users only and monitor for unauthorized attempts to access diagnostic kernel modules.