CVE-2026-87673: OS Command Injection
An OS command injection vulnerability exists in maintenance command-line diagnostic utilities on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. The binary fails to sanitize user-supplied input options when invoking underlying system commands through a shell interpreter. A privileged user with maintenance account access can exploit this issue by supplying crafted parameters, which results in arbitrary OS command execution with root privileges.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Brocade Fabric OSto a version that resolves this vulnerability.Fixed in 9.2.2d - Upgrade
Upgrade
Brocade Fabric OSto a version that resolves this vulnerability.Fixed in 10.0.1
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
Exploitation requires a privileged user with maintenance account access to the affected Fabric OS command-line diagnostic utilities. The attacker must be able to provide crafted input options to those utilities.
What level of access can successful exploitation provide?
Successful exploitation results in arbitrary operating-system command execution with root privileges.
Which Fabric OS releases are affected?
Affected releases are Fabric OS versions before 9.2.2d, and versions 10.0.0 through 10.0.0a1.