CVE-2026-87687: CWE-88: Improper Neutralization of Argument Delimiters or Special Sequences in Commands in Brocade Fabric OS

This vulnerability (CVE-2026-87687) in Brocade Fabric OS involves improper neutralization of argument delimiters or special sequences in commands (CWE-88). An authenticated user with limited privileges in a single Virtual Fabric can submit a specially crafted request containing an arbitrary fabric identifier, bypassing authorization checks. This leads to unauthorized cross-fabric operations and disclosure of configuration details in other tenants or Virtual Fabrics to which the user should not have access. The affected versions are all releases before 9.2.2d and versions from 10.0.0 up to and including 10.0.0a1.

An attacker with authenticated access and restricted privileges in one Virtual Fabric can perform unauthorized operations across different Virtual Fabrics and view sensitive configuration information of other tenants. This compromises the confidentiality and integrity of the fabric configurations and potentially impacts multi-tenant isolation within Brocade Fabric OS environments.

No explicit patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user privileges carefully and monitor for unusual cross-fabric access attempts.