Brocade Fabric OS wave (~18 GHSAs): in-band Fibre Channel peer auth bypass¶

Wave in one line: SAN management-plane wave: in-band Fibre Channel peer auth bypass, IdP-claim role binding, and header-as-transport trust on the forgotten fabric network

Source: hourly offensive-security scan of GitHub Security Advisories, 2026-10-08 (wave published 2026-10-08T03:31Z, ~18 advisories, CVE-2026-87659 through CVE-2026-87686 plus CVE-2026-94578/94582/94583; fixed band Fabric OS before 10.0.1).

One theme ties the batch: a SAN fabric is a second, unmonitored network with its own in-band management protocol, and Fabric OS treats that protocol — plus client-controlled HTTP fields and IdP-returned claims — as stronger evidence of authority than the transport layer. Data-center engagements routinely scope the Ethernet management VLAN and never the Fibre Channel fabric; FC switches sit on the same management networks as everything else. Every leg is individually testable in an authorized lab or customer-approved data-center assessment.

Advisory table (fixed band: Fabric OS < 10.0.1)¶

Tracked without standalone treatment: none material beyond the table — memory-safety admin-tier legs (fmmw/ph5j/rphp/7gvw) are listed for fingerprint completeness.

Why this is worth an operator page¶

• The fabric is a trusted message bus, and in-band CT is an authentication-free admin channel. The marquee leg (6h29) means once any switch is compromised — or any host with an HBA is footholded — the attacker joins the fabric and speaks vendor-unique Common Transport admin requests to every other switch with no credentials: reset admin passwords, reboot, push firmware. Data-center engagement rule: ask whether FC switches / SAN zones are in scope; if a host with an HBA is in scope, the fabric is reachable in fact. Fingerprint with sclt, finddev, fabricShow equivalents from a footholded HBA host; validate only in labs or customer-approved SAN windows — firmware-download legs are destructive on production fabrics.
• IdP-returned attributes are authorization inputs, not just identity inputs. The AAA leg (6chm) is the appliance flavor of the Sept 16 IdP-authority page: the RADIUS VSA / LDAP claim that selects your admin role comes from a server the appliance merely trusts at session-establishment time. Audit any appliance with RADIUS/TACACS+/LDAP/federated login: capture the Access-Accept/claim set a real admin session receives, then test replaying or crafting those attributes from an identity provider you control (disposable tenant, fake RADIUS with freeradius in a lab). Vendor role-attribute names are frequently guessable from docs — the check "does the appliance validate which IdP sent this attribute, or only that an attribute arrived" is the finding.
• Proprietary-protocol opcode space is wider than the RBAC classifier. The opcode leg (h7f4) generalizes: with read-only credentials, drive non-standard/reserved action opcodes of the management protocol, not just the documented verbs. The classifier maps the verbs the docs name; the executor accepts more. Same shape as the Oct 6 Coraza cap-semantics lesson — the gate and the worker disagree about input space; here the gate's opcode taxonomy is smaller than the handler's.
• Two client-controlled-string trust decisions that should have used the socket. Headers-only internal gating (w843) and Host-header-as-transport-trust (3whm) are one sweep: on any appliance web/REST surface, (a) attempt internal/admin endpoint families with guessed internal headers (X-Forwarded-*, product-internal names — brute from JS bundles and error text), and (b) move between IP-filtered zones by rewriting Host while your socket source stays outside the allowlist. Positive/negative decision table per endpoint. See also the Sept 15 header/parser-route page.
• Logical-switch = tenant, and the scope check was absent. MAPS dump (f78x) reads chassis-wide data across all logical switches with any authenticated low-privilege account — the Sept 18 ignored-scope page tenancy harness applies: enumerate every read endpoint and diff what a scope-limited principal sees vs an admin; any endpoint whose response contains foreign-logical-switch identifiers is a finding.
• Directory-integration expands the attacker set to the enterprise AD/LDAP forest. The session-verification cmdi (m36q) explicitly names a compromised directory service account as the exploit principal — one phished AD credential becomes OS command execution on storage-network appliances. In red-team scope-mapping, every appliance with LDAP/AD login binding is a pivot from enterprise credential compromise to the storage/SAN plane; note the reverse for reporting: cmdi in the session-verification path means the payload rides a username or attribute, fuzz shell metacharacters into every identity field (;, `, $(), space variants) during authenticated-leg testing.
• Config-import files are a pre-activation injection surface. The FA issuer leg (2fjw) needs only the ability to supply a config file for import — directive injection into the web daemon from an issuer string. For any appliance with "import configuration" or "apply IdP metadata/file" flows, treat every string field in the import schema as an injection target into the generated server config; validate in a lab import, never on a production management daemon.
• Support bundles are standing credential targets. SupportLink cleartext proxy creds (hrhr) extend the Veeam log-directory rule from the Oct 7 Veeam page: diagnostic/support bundles from network appliances routinely embed proxy URLs, tokens, and config state. On engagements, locate where bundles are stored (shares, TFTP/FTP drop points, support-portal caches) and grep bundles for ://.*:.*@ proxy-credential shapes.
• Unauthenticated reachables for fingerprinting: SNMPv3 (default-config overflow surface), UDP/500 on FCIP extension blades (a single IKE_INIT-shaped packet hits a parser with no handshake state), and the web management daemon (query-string numeric range crash). If you see FCIP/IPsec-enabled FC switch management IPs on a scoped network, you are looking at unauthenticated memory-corruption surface — report reachability plus version band (< 10.0.1) rather than firing packets at production fabrics.
• Concurrent-request response crosstalk (gwmc) is a low-sev but reusable probe: for management endpoints that build responses from a per-request address/context variable, send N concurrent distinct requests from two lab principals and diff response bodies against expected — swapped context = cross-user disclosure primitive.

Validation boundaries¶

All legs are appliance-internal; run against lab Fabric OS < 10.0.1 or customer-approved windows. The firmware-download, reboot, and password-reset legs (6h29) and every overflow packet are destructive-class on production fabrics — route through owned lab switches. IdP-claim proofs should use disposable identity providers you control; never replay real admin session attributes captured from a live network into another appliance.

October 8 06:31Z follow-up: second coordinated wave — legacy 9.2.2d branch, a shell-out genealogy across admin flows, and the SANnav VM as credential aggregation point¶

A second Brocade wave landed the same day (published 2026-10-08T06:31Z, ~17 Fabric OS advisories fixed before 9.2.2d / 10.0.0a1 plus four SANnav advisories fixed <3.0.0a/3.0.1 and two ASCG backfills). The earlier wave fixed <10.0.1; this one patches the legacy 9.2.2d branch — meaning long-lived, unpatched-by-default estates (SAN gear cycles on multi-year firmware schedules) carry this entire class. Version band is the fingerprint: 9.2.x switches in the wild are the target population.

New legs worth an operator rule each:

• Platform-gated unauthenticated SSO endpoint (MXG610). CVE-2026-94585 / GHSA-v822-xrfp-fv6q (high): an unauthenticated endpoint inside the SSO workflow in the web management interface of Fabric OS <9.2.2d running on the MXG610 platform yields admin. Platform-conditional auth surface = edition gating is a fingerprint: enumerate which management features the specific hardware platform registers, then probe SSO/OAuth workflow endpoints (callback, assertion-consume, token-exchange shapes) unauthenticated on that platform only. Same theme as the Vault policy-cache Enterprise-only leg — feature presence varies by SKU, and the docs describe the SKU you're not looking at.
• Local IPC session-context forgery. CVE-2026-87664 / GHSA-g9wq-5j4p-ph88 (high): the web management daemon accepts and registers session structures (admin role flags, user IDs) from local IPC storage callbacks without verifying the sending process's identity — a local process (any lower-privilege foothold on the switch OS) injects an admin session into the web UI. Local IPC peers are attackers, not neighbors — the CoreWCF local-transport lesson again on an appliance: any daemon that builds auth state from IPC messages must authenticate the peer; on appliances with a restricted shell (admin/user CLI jail), test whether jail-escaped code can speak to the web daemon's IPC channel and mint itself a session.
• The admin-flow-to-shell genealogy is wide. This wave names seven distinct admin-feature paths that concatenate parameters into system()-executed shell strings: config download/remote server profiles (CVE-2026-94586 / GHSA-mpc4-4j34-c9v6, root), SSH known-hosts settings (CVE-2026-94581 / GHSA-rwc7-45pp-f64j, root), firmware upgrade download host/path params (CVE-2026-87662 / GHSA-hrf2-53wv-vghq, daemon privilege), certificate deletion cert-id (CVE-2026-87688 / GHSA-rcqv-rx42-jrx2), account deletion key-cleanup routine fed a malformed account name accepted at creation (CVE-2026-87677 / GHSA-fw7w-5rwg-xvrv), config relay host strings that ride a stored config file into the download utility — malicious-or-compromised config executes when an admin later clicks download (CVE-2026-87675 / GHSA-866x-57qx-q5cx), and PAM session cleanup at SSH disconnect fed by username/profile-ID metacharacters from an external directory (CVE-2026-94579 / GHSA-rcgg-cjm3-3p46, root). Durable rules: (1) deferred-execution payloads — the config-relay leg stores metacharacters and detonates on a future admin action; config-import/export files are time-bombs, audit every field a config file carries into a later utility invocation. (2) The cleanup/teardown path is a sink too — account delete, session close, cert revoke are where input validation was never re-applied: fuzz identity-shaped fields (username, cert serial, account name) with shell metacharacters and exercise the teardown, not just the create path; where creation-side validation is the fix, ask whether the stored value ever reaches a shell after creation. (3) The PAM leg repeats the m36q lesson from the first wave — an enterprise directory account is the exploit principal: metacharacters ride the AD/LDAP username and execute at session termination.
• Inter-switch remote-execution IPC frames (legacy-branch flavor). CVE-2026-87663 / GHSA-c66x-7fmm-f2xw (high) is the same trust inversion as the marquee 6h29 in-band CT leg but through the remote command execution IPC service: a switch on the fabric processes remote-exec frames without parameter verification, executing root commands locally and across other fabric members where remote exec is enabled. Two advisories, one root truth restated with more blast radius: peer-on-fabric = root on every member with the feature enabled. When mapping a compromised-switch scenario in reporting, name the enabled-remote-exec members as the lateral set (fabricShow/adminShow visible from any switch session).
• Virtual Fabric = tenant (again, legacy branch). CVE-2026-87687 / GHSA-hvhq-wqcx-2hjw (high): a restricted user in one Virtual Fabric submits a crafted fabric identifier to perform operations and read configuration in other Virtual Fabrics — the f78x logical-switch tenancy miss reappears on the legacy branch via a different parameter. Sweep rule unchanged: any request field that names a fabric/zone/VS context is a scope parameter — substitute a foreign identifier with a low-privilege principal and diff.
• RBAC logic bypass + cross-account role assignment. CVE-2026-94575 / GHSA-756g-ccf7-9xr2 (med): "specific environmental conditions" lower the active session's authorization mode, exposing admin-only config — an environment-conditional RBAC downgrade, test by varying session establishment order/flags with a low-priv account. CVE-2026-94576 / GHSA-6f5c-jcvm-jxh5 (med): a lower-privileged user assigns admin roles to a target account (another user, not self) — cross-account privilege mutation, the self-grant class with the target moved; test both spellings (self, foreign) on every role-assignment endpoint.
• SANnav: the management VM is the credential aggregation point. Four SANnav advisories turn the SAN management server into the prize: switch admin passwords captured in plaintext in the host memory swap file under OOM conditions (CVE-2026-5769 / GHSA-9rgp-c27m-xwjf, <3.0.1), encoded passwords and auth tokens printed into log files and the supportsave bundle (CVE-2026-5047 / GHSA-vrg4-pprr-h7xv, <2.4.0b/3.0.0), authenticated SQLi in external API REST -query parameters (CVE-2026-5048 / GHSA-8gcr-rfxc-ph8p, <3.0.0a), and Zone Alias Import upload writing outside the intended directory (CVE-2026-5049 / GHSA-x7h7-73v6-3j7c, local authenticated). Operator rule: owning the SAN management VM yields every switch's admin credential — SANnav stores/browses/log-dumps Fabric OS admin passwords by design, so the VM's host (swap files, logs, support bundles), its REST API, and its import flows are all higher-value targets than any single switch. On data-center engagements, SANnav/SAN-management VMs get the same post-footloose credential hunt as the Veeam log-directory and Brocade SupportLink rules: grep swap, logs, and bundles for password/token shapes; -query REST params get the SQLi battery.
• Tracked without publication: Apache-config DoS on service bring-up (GHSA-mxfh-hfg3-4hfp), WebTools buffer overflow (GHSA-m2ph-j5qr-j44m), web-daemon race (GHSA-wfqf-hvcg-7p66), USB-path arbitrary deletion (GHSA-h3q5-w97j-6289) and status-file arbitrary move (GHSA-8vxx-q3j7-g458) — path-boundary + memory-safety classes canonical; ASCG CVE-2023-5648/5649 historical backfills (missing security headers, input validation) noted for fingerprint completeness.

October 8 09:31Z follow-up: third wave — Brocade ASCG (Access Services Control Gateway) before 3.5.0: unauthenticated control planes, binary-embedded keys, and the VM-local credential hop¶

A third Brocade product family landed the same day: ~12 ASCG advisories fixed before 3.5.0. Same engagement lesson as Fabric OS/SANnav — the SAN/streaming management appliances are the soft target in the data center — plus three new durable axes.

Operator rules this wave adds:

• Binary-embedded keys are estate-wide keys. The static-key leg (85422) and SupportLink key (87424) both ship one secret to every customer deployment. On any appliance engagement: pull the binaries (firmware image or the VM itself), grep for key material and signing constants, and test whether inter-node/sync traffic is authenticated with them — a forged admin sync message is the clean proof path in a lab (replay-shaped, no production impact). Same conclusion as the SANnav credential-aggregation rule one level deeper: for these products, one key extraction defeats every deployment, so public firmware images are a legitimate offline research target.
• Appliance "reachability helpers" are unauthenticated pivot proxies when their auth is missing. The data-collector SSH leg (85423) turns the appliance into an execution vector along the network paths the appliance is whitelisted for — the collector can reach switch management IPs your pentest box cannot. On scoped data-center assessments, enumerate collector/agent/probe API endpoints (data-collect, probe, test-connection shapes) and check auth per endpoint; an unauthenticated "connect to host X and run Y" endpoint beats any pivoting you could do yourself. Proof: your own owned listener host receives an SSH connection sourced from the appliance.
• TLS trust stores are writable authorization state. The rogue-CA leg (87425) is the mirror of certificate-pinning findings: if any unauthenticated or low-privilege interface can add a CA, the appliance's outbound trust — including connections to the devices it administers — becomes MITM-able. Sweep every cert/CA upload endpoint (enrollment, trust-store import, IdP metadata) for auth gating, and remember the injected CA persists into future sessions, so treat trust-store writes as durable like a config change.
• The OVA is the audit surface. Default password embedded in a customer-distributed script (85488) + VM-local namespace credential extraction (87428) both assume only "read access to the appliance VM." Downloading a vendor OVA and reading it offline turns both into pre-engagement recon; on live assessments, any foothold user on the management VM (even jail-restricted) is a candidate principal for namespace/network-local API calls to sibling service VMs — test lateral HTTP to SANnav/management hosts from the foothold before theorizing an escape.
• Ingested archives are attacker-controlled when the "remote endpoint" is. Bundle ingestion with unsanitized entry paths (85490) is the Zip Slip class applied to support workflows: if the appliance pulls bundles from configurable remote endpoints or an attacker can intercept/proxy that channel (see the rogue-CA leg), traversal entries write arbitrary files. Audit every "fetch archive from URL/peer" flow, not just user-facing upload forms.
• Validate everything against lab ASCG < 3.5.0; SSH-execution and file-write legs are destructive-class against real managed switches — use owned listener hosts and disposable files only.