The vulnerability is an OS command injection in the REST API management interface of Brocade Fabric OS. An attacker who has authenticated, high‑privileged access can supply crafted parameter values containing shell metacharacters, allowing arbitrary system commands to be executed with root permissions and effectively granting full control over the host.

Affected systems include all Brocade Fabric OS releases prior to 9.2.2d and 10.0.0 through 10.0.0a1. Versions 9.2.2d and 10.0.1 contain the security update that mitigates the issue; earlier releases remain vulnerable.

The CVSS score of 8.5 indicates high severity and the EPSS score of 1% indicates a very low probability of exploitation, though the flaw is not listed in CISA KEV. The likely attack path involves an authenticated administrator using the REST API to change SSH known‑host settings; the vulnerability is exploitable remotely from any network location that can reach the API endpoints. Because the affected functionality requires administrative credentials, exploitation is limited to users with high privileges.