Skip to content
Heist/ feed
High

CVE-2026-87663

Type: advisorySource: Official CVE List1 source record

An authentication bypass and command injection vulnerability exists in the inter-switch remote execution service of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When processing remote command execution IPC frames across the fabric, the receiving switch processes these commands at an elevated processing level without proper verification of transmitted parameters. This allows an attacker on a single fabric-connected switch to escalate privileges and execute arbitrary root commands locally or across other managed fabric members where remote execution functionality is enabled.

Announced Source revision 1
Original source ↗

CVE-2026-87663

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-87663

Fabric OS

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "vendor": "Brocade",
    "product": "Fabric OS",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "9.2.2d",
        "versionType": "Brocade FabricOS"
      },
      {
        "status": "affected",
        "version": "10.0.0",
        "versionType": "Brocade FabricOS",
        "lessThanOrEqual": "10.0.0a1"
      }
    ],
    "defaultStatus": "unaffected"
  }
]
Related CVEs
CVE-2026-87663

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#16184 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement