CVE-2026-87682: OS Command Injection
Multiple OS Command Injection vulnerabilities exist in the management interface and session processing routines of Brocade Fabric OS versions before 10.0.1. Input processing flaws during remote management connection validation and session verification for directory-based user accounts allow untrusted input containing shell metacharacters to reach internal system execution wrappers. An authenticated user or a compromised directory service account can exploit these vulnerabilities to execute arbitrary operating system commands with elevated privileges on the target device.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Brocade Fabric OSto a version that resolves this vulnerability.Fixed in 10.0.1
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
Exploitation requires an authenticated user or a compromised directory service account. The affected code paths involve remote management connection validation and session verification for directory-based user accounts.
What level of access can an attacker gain?
An attacker can execute arbitrary operating system commands with elevated privileges on the affected Brocade Fabric OS device. The CVSS vector indicates high impact to confidentiality, integrity, and availability.
Are installations using directory-based accounts affected?
Directory-based user accounts are specifically implicated in the vulnerable session-verification routines. Environments that use such accounts for remote management should prioritize updating.
What version fixes the issue?
The vulnerability affects Brocade Fabric OS versions before 10.0.1. Updating to version 10.0.1 or later addresses the affected version range described in the advisory.