Brocade Fabric OS CVE-2026-87667

Exploitation requires an authenticated administrative account on the Brocade Fabric OS configuration-management CLI and use of a configuration-viewing command that accepts a search-pattern filter option; the attacker supplies a malicious search string that is passed unsanitized to an internal search command. Limiting factors: prior valid credentials with (per vendor) PR:H or (per description) low-privilege admin access are mandatory, adjacent-network reachability to the switch management plane is needed (AV:A), and affected builds are Fabric OS before 9.2.2d or 10.0.0 through 10.0.0a1 - patched or unaffected versions remove the issue. No unauthenticated or purely remote-internet exploitation path is indicated.

This is a genuine but conditional risk rather than a drop-everything emergency. The vendor-supplied CVSS 4.0 score of 8.4 (High) is driven largely by cascading subsequent-system impacts (SC:H/SI:H/SA:H) layered on a confidentiality-only primary impact (VC:H, VI:N, VA:N) - the elevation reflects that stolen password hashes and secrets can enable follow-on compromise, not that this flaw alone breaks integrity or availability. Crucially, exploitation requires an already-authenticated administrative user: the vendor vector sets PR:H, while the description itself says 'low-privilege administrative access,' a discrepancy worth verifying with Broadcom (PR:H vs the described low-privilege role). The attack vector is AV:A (adjacent), consistent with reaching the switch management plane, and AC:L means the technique is reliable once access exists. No EPSS score, no CISA KEV listing, and no public exploit were provided, so there is currently no public exploit identified at time of analysis and no evidence of active or widespread exploitation. Net: treat as a privilege-boundary / local-file-disclosure issue on managed SAN infrastructure - patch on a normal-to-expedited cycle, prioritizing switches where many lower-trust administrators have CLI accounts, but it is not a wormable internet-facing critical.

A low-privilege administrator with CLI access to a Brocade Fabric OS switch runs a configuration-viewing command and supplies a crafted search-pattern filter that injects extra arguments into the internal search command (CWE-88). Because the search string is not sanitized, the injected arguments cause the utility to read files outside its intended scope, letting the attacker exfiltrate system password hashes and secrets to crack offline or reuse for privilege escalation and lateral movement. No public proof-of-concept was provided, and exploitation is gated by prior authenticated management access.