CVE-2026-87673
Received Received - Intake

OS Command Injection in Brocade Fabric OS

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: Brocade Communications Systems, LLC

Description
An OS command injection vulnerability exists in maintenance command-line diagnostic utilities on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. The binary fails to sanitize user-supplied input options when invoking underlying system commands through a shell interpreter. A privileged user with maintenance account access can exploit this issue by supplying crafted parameters, which results in arbitrary OS command execution with root privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-08
Last Modified
2026-10-08
Generated
2026-10-08
AI Q&A
2026-10-08
EPSS Evaluated
N/A
NVD
CVE-2026-87673
EUVD
EUVD-2026-94688

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Brocade Fabric OS 0
Brocade Fabric OS 10.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an OS command injection vulnerability in Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. The issue occurs in maintenance command-line diagnostic utilities where user-supplied input is not properly sanitized before being passed to system commands. A privileged user with maintenance access can exploit this to execute arbitrary OS commands with root privileges.

Detection Guidance

Detecting this vulnerability requires checking the Brocade Fabric OS version and inspecting maintenance command-line utilities for potential command injection flaws. Verify if your system runs versions before 9.2.2d or 10.0.0 through 10.0.0a1. Examine diagnostic utilities for improper input sanitization in system command invocations.

Impact Analysis

If you are a privileged user with maintenance account access on affected Brocade Fabric OS versions, an attacker could exploit this to gain root-level control of the system. This could lead to unauthorized data access, system compromise, or disruption of services.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements such as GDPR (data protection) or HIPAA (health information privacy). Organizations using affected versions may face regulatory penalties or legal consequences if exploited.

Mitigation Strategies

Immediately upgrade Brocade Fabric OS to version 9.2.2d or later, or 10.0.0a2 or later if using version 10.0.0. Restrict access to maintenance accounts and disable unnecessary diagnostic utilities until patched. Monitor system logs for suspicious command execution attempts by privileged users.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-87673. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart