CVE-2026-82369

Received Received - Intake

Authenticated Command Injection in Brocade SANnav CLI

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: Brocade Communications Systems, LLC

Description

Insufficient input sanitization of shell metacharacters in the Brocade SANnav CLI scripting component permits authenticated users to break out of restricted execution contexts on managed switches. An attacker with command execution permissions can leverage this flaw to run unauthorized shell commands across target fabric switches, bypassing command allow-lists and obtaining full administrative switch access. This vulnerability affects all Brocade SANnav versions before 3.0.1a.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-09-23

Generated

2026-09-24

AI Q&A

2026-09-24

EPSS Evaluated

N/A

NVD

CVE-2026-82369

Affected Vendors & Products

Vendor	Product	Version / Range
brocade	sannav	to 3.0.1a (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability involves insufficient input sanitization in the Brocade SANnav CLI scripting component. Authenticated users can exploit shell metacharacters to escape restricted execution contexts on managed switches. An attacker with command execution permissions can run unauthorized shell commands across target fabric switches, bypassing command allow-lists and gaining full administrative access.

Impact Analysis

If you use Brocade SANnav versions before 3.0.1a, an attacker with authenticated access could exploit this flaw to execute arbitrary commands on your switches. This could lead to unauthorized administrative access, potential data breaches, or disruption of network operations.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements under GDPR and HIPAA. Organizations may face legal penalties, data breach notifications, and reputational damage if this flaw is exploited.

Mitigation Strategies

Upgrade Brocade SANnav to version 3.0.1a or later to address the insufficient input sanitization flaw in the CLI scripting component.

Hi! I’m here to help you understand CVE-2026-82369. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70