CVE-2026-82370: Unauthenticated remote command injection in the Brocade SANnav orchestrator HTTP service
Unauthenticated remote command injection in the Brocade SANnav orchestrator HTTP service permits network-adjacent attackers to execute arbitrary administrative switch CLI commands and issue container management instructions. This could allow an attacker to alter Fibre Channel fabric switch configurations or manipulate application container runtimes. This vulnerability affects Brocade SANnav versions before 3.0.1a.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Brocade SANnavto a version that resolves this vulnerability.Fixed in 3.0.1a
Event History
Frequently Asked Questions
Who can exploit this issue?
A network-adjacent attacker can exploit it without authentication if they can reach the SANnav orchestrator HTTP service.
What access does successful exploitation provide?
An attacker can execute arbitrary administrative switch CLI commands and issue container management instructions, potentially altering Fibre Channel fabric switch configurations or manipulating application container runtimes.
Which deployments are affected?
Brocade SANnav versions earlier than 3.0.1a are affected. The provided information does not identify any configuration prerequisite beyond exposure of the orchestrator HTTP service.