Description
Multiple OS Command Injection vulnerabilities exist in the management interface and session processing routines of Brocade Fabric OS versions before 10.0.1. Input processing flaws during remote management connection validation and session verification for directory-based user accounts allow untrusted input containing shell metacharacters to reach internal system execution wrappers. An authenticated user or a compromised directory service account can exploit these vulnerabilities to execute arbitrary operating system commands with elevated privileges on the target device.
Published: 2026-10-08
Score: 8.6 High
EPSS: 1.7% Low
KEV: No
Impact: Unauthorized OS Command Execution
Action: Apply Patch
AI Analysis

Impact

Multiple OS command injection flaws have been identified in Brocade Fabric OS management interfaces and session processing. The weaknesses allow untrusted input containing shell metacharacters to reach internal execution wrappers. An attacker with authenticated account privileges, or one who has compromised a directory service account, can exploit these vulnerabilities to run arbitrary operating‑system commands with elevated rights on the device.

Affected Systems

Affected products are Brocade Fabric OS versions prior to 10.0.1. Any deployment running an earlier release is vulnerable; newer releases contain the security update.

Risk and Exploitability

The vulnerability carries a CVSS score of 8.6, indicating high severity. EPSS data is not available and the issue is not listed in the CISA KEV catalog. The attack vector requires authentication or a compromised directory account, meaning that a legitimate user or a malicious actor who has stolen credentials can execute arbitrary commands remotely.

Generated by OpenCVE AI on October 8, 2026 at 02:23 UTC.

Remediation

Vendor Solution

Security update is provided in Brocade Fabric OS 10.0.1

OpenCVE Recommended Actions

  • Upgrade Brocade Fabric OS to version 10.0.1 or later to apply the vendor’s security update.
  • Restrict access to the management interface to trusted administrators and enforce strong authentication mechanisms.
  • If a patch cannot be applied immediately, disable or tightly restrict directory‑based user accounts that are used for remote management and monitor access logs for suspicious input patterns.

Generated by OpenCVE AI on October 8, 2026 at 02:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 17:45:00 +0000

Type Values Removed Values Added
First Time appeared Broadcom
Broadcom fabric Operating System
CPEs cpe:2.3:o:broadcom:fabric_operating_system:*:*:*:*:*:*:*:*
Vendors & Products Broadcom
Broadcom fabric Operating System
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Thu, 08 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 08 Oct 2026 02:45:00 +0000

Type Values Removed Values Added
First Time appeared Brocade
Brocade fabric Os
Vendors & Products Brocade
Brocade fabric Os

Thu, 08 Oct 2026 01:45:00 +0000

Type Values Removed Values Added
Description Multiple OS Command Injection vulnerabilities exist in the management interface and session processing routines of Brocade Fabric OS versions before 10.0.1. Input processing flaws during remote management connection validation and session verification for directory-based user accounts allow untrusted input containing shell metacharacters to reach internal system execution wrappers. An authenticated user or a compromised directory service account can exploit these vulnerabilities to execute arbitrary operating system commands with elevated privileges on the target device.
Weaknesses CWE-78
References
Metrics cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Broadcom Fabric Operating System
Brocade Fabric Os
cve-icon MITRE

Status: PUBLISHED

Assigner: brocade

Published:

Updated: 2026-10-08T12:59:47.425Z

Reserved: 2026-09-08T22:51:12.186Z

Link: CVE-2026-87682

cve-icon Vulnrichment

Updated: 2026-10-08T12:59:41.194Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-08T02:16:54.420

Modified: 2026-10-13T17:27:59.653

Link: CVE-2026-87682

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-08T02:30:06Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')