{"schemaVersion":3,"id":"CVE-2026-87664","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"A session context forgery vulnerability exists in the web management daemon of Brocade Fabric OS versions 9.2.2d and 10.0.0 through 10.0.0a1. When processing local inter-process communication (IPC) storage callbacks, the service accepts and registers session structures including administrative role permissions, user identifiers, and authorization flags—without verifying the identity or authenticity of the sending process. An attacker can obtain elevated administrative privileges on the web management interface without legitimate authentication.","dates":{"published":"2026-10-08T04:16:03.566Z","modified":"2026-10-09T03:55:35.177Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":8.5,"severity":"high","version":"4.0","versionLabel":"v4.0","source":"CVE.org","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"4.0","versionLabel":"v4.0","source":"CVE.org","score":8.5,"severity":"high","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":false},{"version":"4.0","versionLabel":"v4.0","source":"NVD","score":8.5,"severity":"high","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.8,"severity":"high","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00118,"percentile":0.01646,"severity":"low","asOf":"2026-10-21T00:00:00.000Z","change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[{"date":"2026-10-08T00:00:00.000Z","score":0.00123,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00123,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00123,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00123,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00123,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00123,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00123,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00118,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00118,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00118,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00118,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00118,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00118,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00118,"percentile":0.01646}],"last30":[{"date":"2026-10-08T00:00:00.000Z","score":0.00123,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00123,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00123,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00123,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00123,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00123,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00123,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00118,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00118,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00118,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00118,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00118,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00118,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00118,"percentile":0.01646}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-306","name":"Missing Authentication for Critical Function","description":"The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/306.html"}],"affected":[{"vendor":"broadcom","product":"fabric_operating_system","name":"fabric operating system","label":"fabric_operating_system","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< 9.2.2d","noFixRecorded":false,"fixedIn":null},{"text":"≥ 10.0.0, < 10.0.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.2.2d | ≥ 10.0.0, < 10.0.1","eol":null,"hubHref":"/vendor/broadcom/fabric_operating_system"},{"vendor":"brocade","product":"fabric_os","name":"fabric os","label":"fabric_os","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< 9.2.2d","noFixRecorded":false,"fixedIn":null},{"text":"≥ 10.0.0, ≤ 10.0.0a1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.2.2d | ≥ 10.0.0, ≤ 10.0.0a1","eol":null,"hubHref":"/vendor/brocade/fabric_os"}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://support.broadcom.com/external/content/SecurityAdvisories/0/39164","label":"support.broadcom.com/external/content/SecurityAdvisories/0/39164","hostname":"support.broadcom.com","tags":["Vendor Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-10-08T04:16:03.566Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-10-09T03:55:35.177Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":34,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T10:48:16.769Z","stale":false,"partial":false}}