An OS command injection vulnerability exists in the account management subsystem of Brocade Fabric OS prior to version 9.2.2d and 10.0.0 through 10.0.0a1. When an administrator initiates an account deletion, malformed account names previously accepted by Fabric OS can cause the execution of embedded shell metacharacters, which triggers the execution of arbitrary OS commands. This flaw allows the attacker to execute commands with the privileges of the system process, potentially compromising confidentiality, integrity, and availability of the affected platform.

Brocade Fabric OS, specifically all installations prior to 9.2.2d and from 10.0.0 through 10.0.0a1. The flaw is within the account deletion workflow handled by the internal maintenance routine that cleans up cryptographic keys.

The CVSS score of 5.4 indicates moderate severity, and the EPSS score is not available. The vulnerability is not listed in CISA's KEV catalog. Exploitation requires an administrator performing a deletion with a specially crafted account name; thus the attack vector is local privileged. The potential impact is the execution of arbitrary system commands, equal to a local attacker with administrative privileges.