CVE-2026-87663
Last modified
CVE-2026-87663 is a medium-severity vulnerability rated 6.7/10 on the CVSS scale. An authentication bypass and command injection vulnerability exists in the inter-switch remote execution service of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When processing remote command execution IPC frames across the fabric, the receiving switch processes these commands at an elevated processing level without proper verification of transmitted parameters. EPSS estimates a 0.73% chance of exploitation in the next 30 days.
Description
An authentication bypass and command injection vulnerability exists in the inter-switch remote execution service of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When processing remote command execution IPC frames across the fabric, the receiving switch processes these commands at an elevated processing level without proper verification of transmitted parameters. This allows an attacker on a single fabric-connected switch to escalate privileges and execute arbitrary root commands locally or across other managed fabric members where remote execution functionality is enabled.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Broadcom | Fabric Operating System | < 9.2.2d |
| Broadcom | Fabric Operating System | >= 10.0.0, < 10.0.1 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-87663?
How severe is CVE-2026-87663?
How do I fix CVE-2026-87663?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-87658Information leak in Extensions in Google Chrome prior to 153…4.3
- CVE-2026-87659A critical authorization bypass vulnerability exists in the …9.8
- CVE-2026-8766A flaw has been found in Kilo-Org kilocode up to 7.0.47. Thi…6.5
- CVE-2026-87660An improper file permission and missing authorization vulner…7.1
- CVE-2026-87661Brocade Fabric OS versions before 9.2.2d and 10.0.0 through …5.7
- CVE-2026-87662Brocade Fabric versions before 9.2.2d and 10.0.0 through 10.…6.7
- CVE-2026-87664A session context forgery vulnerability exists in the web ma…7.8
- CVE-2026-87665A stack-based buffer overflow vulnerability exists in the In…7.5
- CVE-2026-87666An OS command injection vulnerability exists in the time and…8
- CVE-2026-87667An argument injection vulnerability exists in the configurat…4.5
- CVE-2026-87668A stack-based buffer overflow vulnerability exists in the di…6.5
- CVE-2026-87669A missing authorization check in Brocade Fabric OS versions …4.3
Are you affected by CVE-2026-87663?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST