CVE-2026-87667
Received Received - Intake

Argument Injection in Brocade Fabric OS Configuration Utility

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: Brocade Communications Systems, LLC

Description
An argument injection vulnerability exists in the configuration management command-line utility of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When executing configuration viewing commands with search pattern filters, the utility fails to sanitize user-supplied search string options before passing them to internal search commands. An authenticated user with low-privilege administrative access can exploit this vulnerability to read arbitrary files on the local operating system, including sensitive configuration files, system password hashes and system secrets.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-08
Last Modified
2026-10-08
Generated
2026-10-08
AI Q&A
2026-10-08
EPSS Evaluated
N/A
NVD
CVE-2026-87667
EUVD
EUVD-2026-94695

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Brocade Fabric OS 0
Brocade Fabric OS 10.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-88 The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an argument injection vulnerability in Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When using configuration viewing commands with search filters, the system does not properly sanitize user-provided search strings. This allows authenticated low-privilege users to inject commands and read arbitrary files on the local system, including sensitive files like configuration data and system secrets.

Detection Guidance

This vulnerability can be detected by checking the Brocade Fabric OS version. If the system is running versions before 9.2.2d or 10.0.0 through 10.0.0a1, it is vulnerable. Use the command 'version' or 'show version' to verify the installed version.

Impact Analysis

An attacker with low-level admin access could exploit this to access sensitive system files, including configuration files, password hashes, and other secrets. This could lead to unauthorized data exposure, privilege escalation, or further compromise of the system.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for data protection and security. GDPR and HIPAA both mandate strict controls to prevent unauthorized access to personal or health information. Exploitation could result in non-compliance, potential fines, and reputational damage.

Mitigation Strategies

Upgrade Brocade Fabric OS to version 9.2.2d or later, or 10.0.0a2 or later. Avoid using low-privilege accounts for administrative tasks until patched. Review and restrict access to configuration viewing commands with search pattern filters.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-87667. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart