Brocade Fabric OS CVE-2026-87660

Requires an authenticated low-privilege local account (PR:L) on a Brocade switch running an affected Fabric OS build (before 9.2.2d, or 10.0.0 through 10.0.0a1); the vulnerable diagnostic kernel module subsystem is a standard FOS component. No user interaction is needed (UI:N). Exploitation is limited to actors who already hold shell/CLI access to the device - it is not described as remotely unauthenticated - and the description scopes the attacker to a 'local user,' which contradicts the input vector's AV:A and should be confirmed. Impact is restricted to integrity/availability (hardware tests, error conditions, blade resets, fabric disruption); no data disclosure is enabled.

This is a moderate-risk, locally-exploitable flaw rather than an urgent internet-facing emergency. The CVSS 4.0 base score of 7.0 (HIGH) is driven by high integrity and availability impact (VI:H/VA:H) with no confidentiality impact (VC:N), and requires only low privileges (PR:L) with no user interaction. A notable conflict exists in the source data: the vendor CVSS vector uses AV:A (adjacent network), but the description explicitly states 'an unprivileged local user' and attributes the flaw to improper file permissions on a kernel module (CWE-732), which points to local vector (AV:L) - verify the true attack surface with Broadcom, as this materially affects reachability. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation - exploitation status is 'no public exploit identified at time of analysis.' Combined with the requirement for pre-existing authenticated access to the switch, real-world priority is moderate: patch in normal maintenance cycles rather than emergency, prioritizing SAN switches where untrusted or lower-tier operators hold shell/CLI accounts.

An unprivileged but authenticated local user on a Brocade Fibre Channel switch leverages insecure permissions on the diagnostic kernel module subsystem to invoke privileged hardware diagnostic tests normally restricted to administrators. By forcing error conditions or resetting hardware blades, the user disrupts storage fabric operations, causing a denial of service to attached storage traffic. No public exploit code was identified in the provided data, and the attack requires prior low-privilege access to the device.