CVE-2026-87664: CWE-306: Missing Authentication for Critical Function in Brocade Fabric OS

This vulnerability arises because the web management daemon in Brocade Fabric OS improperly processes local inter-process communication storage callbacks by accepting session structures that include administrative roles and authorization flags without authenticating the sending process. As a result, an attacker can forge session contexts and escalate privileges to administrative level on the web management interface. The affected versions are those prior to 9.2.2d and from 10.0.0 up to and including 10.0.0a1. The CVSS 4.0 score is 8.5, indicating high severity with local attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability.

An attacker with local access and limited privileges can exploit this vulnerability to gain unauthorized administrative privileges on the web management interface of Brocade Fabric OS. This could lead to full control over the management functions of the device, potentially compromising the fabric's security and operations.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local access to the affected systems and monitor for suspicious activity related to the web management interface.