CVE-2026-87674: OS Command Injection
A local privilege escalation vulnerability exists in the system logging daemon of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. Insufficient access controls on internal inter-process communication (IPC) channels allow an unprivileged local user to submit malformed logging configurations. Due to improper input sanitization during configuration file generation, an attacker can inject arbitrary directives that execute with elevated privileges when the logging service reloads, leading to local privilege escalation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Brocade Fabric OSto a version that resolves this vulnerability.Fixed in 9.2.2d - Upgrade
Upgrade
Brocade Fabric OSto a version that resolves this vulnerability.Fixed in 10.0.1
Event History
Frequently Asked Questions
Which deployments are affected?
Affected versions are Brocade Fabric OS before 9.2.2d, plus versions 10.0.0 through 10.0.0a1. The issue is in the system logging daemon.
What access does an attacker need?
An attacker needs local access as an unprivileged user. No user interaction is required, and the attack complexity is rated low.
How does exploitation lead to elevated privileges?
The attacker submits malformed logging configurations through insufficiently protected internal IPC channels. Improper sanitization during configuration file generation allows arbitrary directives to be injected and executed with elevated privileges when the logging service reloads.