CVE-2026-87681

MediumCVSS 6.3/10Last modified Oct 13, 2026

Description

An Access Control Bypass vulnerability exists in the Role-Based Access Control (RBAC) validation engine of Brocade Fabric OS versions before 10.0.1. When processing certain management protocol operations, the RBAC engine incorrectly categorizes non-standard action opcodes during permission checks. This allows authenticated users with read-only management privileges to bypass access controls and execute restricted administrative operations.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-269

Affected software

VendorProductVersions
BrocadeFabric OS< 10.0.1

References

Timeline

Published
Oct 8, 2026
Last modified
Oct 13, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-876828.8Multiple OS Command Injection vulnerabilities exist in the management interface and session processing routines of Brocade Fabric OS versionCVE-2026-876838.8Multiple stack-based buffer overflow vulnerabilities exist in the REST API management component of Brocade Fabric OS versions prior to 10.0.CVE-2026-876849.8A stack-based buffer overflow vulnerability exists in the SNMP daemon request handling of Brocade Fabric versions before 10.0.1. When procesCVE-2026-876856.8An arbitrary file manipulation vulnerability exists in the WebTools management interface of Brocade Fabric OS versions before 9.2.2d and 10.CVE-2026-876864.3An authentication and access control bypass vulnerability exists in the web server management interface of Brocade Fabric OS versions beforeCVE-2026-876877.3An authorization and input validation vulnerability exists in Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An autheCVE-2026-876886.8An input validation vulnerability exists in the security certificate management component of the Brocade Fabric OS administrative managementCVE-2026-876899.8The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServlet. Every mutatCVE-2026-87696.5A vulnerability was determined in vercel ai up to 3.0.97. The impacted element is the function createJsonResponseHandler/createJsonErrorRespCVE-2026-876908.8The Metasploit Framework post module post/apple_ios/gather/ios_image_gather is affected by a relative path traversal vulnerability (CWE-22).CVE-2026-876917.8Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally.CVE-2026-876927.8Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.