CVE-2026-87663: CWE-290: Authentication Bypass by Spoofing in Brocade Fabric OS

This vulnerability in Brocade Fabric OS's inter-switch remote execution service allows an attacker on a fabric-connected switch to bypass authentication and inject commands. The receiving switch processes remote command execution IPC frames with elevated privileges but lacks proper verification of transmitted parameters. This leads to privilege escalation and arbitrary root command execution locally or across other managed fabric members where remote execution is enabled. The affected versions are all versions prior to 9.2.2d and versions from 10.0.0 up to and including 10.0.0a1.

An attacker with access to a single fabric-connected switch can escalate privileges to root and execute arbitrary commands locally or on other managed fabric switches where remote execution is enabled. This compromises the integrity and control of the fabric network, potentially allowing full control over affected devices.

No explicit patch or remediation information is provided in the vendor advisory or input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to fabric-connected switches and disable remote execution functionality if possible to reduce risk.