What’s Vulnerable › Vulnerabilities
CVE-2026-87686
- Severity: medium (CVSS 4.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-08 · updated 2026-10-14
- Weakness: CWE-290
Description
An authentication and access control bypass vulnerability exists in the web server management interface of Brocade Fabric OS versions before 10.0.1. The web dispatcher routine evaluates internal management VLAN trust decisions using the client-supplied HTTP host header instead of the actual socket transport layer source IP address. Successful exploitation allows the attacker to bypass IP-filtering access control lists (ACLs) and obtain sensitive device metadata (such as model, serial number, hardware revision, and firmware version) without authentication.
Affected products
- Brocade Fabric OS: before 10.0.1 — fixed in 10.0.1
How to fix
Upgrade to a fixed version: Brocade Fabric OS 10.0.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-87686 or the next vulnerability affects your stack