CVE-2026-82368: High severity Brocade SANNav vulnerability
Insecure access controls on internal service ports in Brocade SANnav versions before 3.0.1a allow local, non-administrative host users to communicate directly with backend management services. A local attacker can leverage this exposed access to transmit commands to connected Fabric OS switches under the security context of the SANnav management user.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Brocade SANnavto a version that resolves this vulnerability.Fixed in 3.0.1a
Event History
Frequently Asked Questions
Who can exploit this issue?
A local, non-administrative user on the host running the affected SANnav version can exploit it. Remote-only attackers are not described as having a path to the exposed internal service ports.
What access does an attacker gain through exploitation?
The attacker can communicate directly with backend management services and send commands to connected Fabric OS switches. Those commands are issued under the security context of the SANnav management user.
Are all SANnav deployments affected?
The issue affects Brocade SANnav versions before 3.0.1a. The available information does not identify any configuration prerequisite beyond running an affected version.
What version resolves the issue?
SANnav 3.0.1a is not described as affected. Upgrading from a version before 3.0.1a addresses the affected-version condition.