CVE-2026-87685: CWE-73: External Control of File Name or Path in Brocade Fabric OS

This vulnerability arises from improper validation and sanitization of a user-supplied status file path parameter in the WebTools management interface of Brocade Fabric OS. An authenticated admin can exploit this by submitting a crafted status file parameter, causing the system to move arbitrary files to a predictable, world-readable temporary directory. Affected versions include all releases before 9.2.2d and versions from 10.0.0 up to and including 10.0.0a1. The CVSS 4.0 base score is 8.4, indicating high severity with attack vector requiring adjacent network access, low attack complexity, no user interaction, and high impact on confidentiality and integrity.

Exploitation can lead to persistent denial of service, destruction of critical system files, host compromise, and leakage of sensitive information. The attacker must have authenticated administrative privileges, but the impact on system availability, confidentiality, and integrity is high.

No official patch or remediation guidance is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrative access to trusted personnel and monitor for suspicious activity related to configuration transfers.