CVE-2026-87687

HighCVSS 7.3/10Last modified Oct 14, 2026

Description

An authorization and input validation vulnerability exists in Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user with restricted privileges in one Virtual Fabric can exploit this issue by submitting a specially crafted request containing an arbitrary fabric identifier. This allows the user to perform unauthorized cross-fabric operations and view configuration details within tenants/Virtual Fabrics to which they have not been granted access.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-88

Affected software

No affected versions have been published.

Timeline

Published: Oct 8, 2026
Last modified: Oct 14, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-876886.8An input validation vulnerability exists in the security certificate management component of the Brocade Fabric OS administrative management CVE-2026-876899.8The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServlet. Every mutat CVE-2026-87696.5A vulnerability was determined in vercel ai up to 3.0.97. The impacted element is the function createJsonResponseHandler/createJsonErrorResp CVE-2026-876908.8The Metasploit Framework post module post/apple_ios/gather/ios_image_gather is affected by a relative path traversal vulnerability (CWE-22).CVE-2026-876917.8Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally.CVE-2026-876927.8Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.CVE-2026-876937.0Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.CVE-2026-876947.8Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.CVE-2026-876957.8Inclusion of functionality from untrusted control sphere in Microsoft Exchange Server allows an authorized attacker to elevate privileges lo CVE-2026-876967.5Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a net CVE-2026-876978.8Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.CVE-2026-876985.5Out-of-bounds read in Windows Remote Access Service Infrastructure allows an authorized attacker to disclose information locally.