Description
A command injection vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operations of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user with permissions to perform configuration downloads using remote server profiles can supply malicious parameter strings to execute arbitrary shell commands on the switch with root privileges
Published: 2026-10-08
Score: 8.5 High
EPSS: 1.4% Low
KEV: No
Impact: Remote Command Execution
Action: Immediate Patch
AI Analysis

Impact

A command injection flaw in the WebTools administration interface of Brocade Fabric OS allows an authenticated user to supply crafted parameters during configuration download or file transfer operations, causing arbitrary shell commands to run with full root privileges on the switch. The vulnerability is an instance of CWE-78, where unsanitized user input is used in the execution of system commands.

Affected Systems

The flaw exists in Brocade Fabric OS versions earlier than 9.2.2d and in versions 10.0.0 through 10.0.0a1. These affected releases correspond to the Brocade Fabric OS product line.

Risk and Exploitability

The vulnerability carries a CVSS score of 8.5, indicating high severity. The EPSS score is 0.01248 (~1.25%), and the defect is not listed in the CISA KEV catalog. The attack requires an authenticated user with permission to initiate configuration downloads via remote server profiles, so a breach is limited to accounts that have those privileges. No public exploit has been disclosed, and the EPSS score of 0.01248 (~1.25%) indicates a low probability of exploitation; however, the vulnerability remains high risk for accounts with such permissions.

Generated by OpenCVE AI on October 8, 2026 at 19:41 UTC.

Remediation

Vendor Solution

Security update is provided in Brocade Fabric OS 9.2.2d and 10.0.1

OpenCVE Recommended Actions

  • Apply the vendor‑supplied security update to Brocade Fabric OS 9.2.2d or a later release
  • Upgrade to Brocade Fabric OS 10.0.1 or later if the system is running version 10.0.0 through 10.0.0a1
  • Limit or revoke configuration download permissions for users if an immediate upgrade is not feasible

Generated by OpenCVE AI on October 8, 2026 at 19:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 14 Oct 2026 19:45:00 +0000

Type Values Removed Values Added
First Time appeared Broadcom
Broadcom fabric Operating System
CPEs cpe:2.3:o:broadcom:fabric_operating_system:*:*:*:*:*:*:*:*
Vendors & Products Broadcom
Broadcom fabric Operating System
Metrics cvssV3_1

{'score': 6.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

Thu, 08 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 08 Oct 2026 20:00:00 +0000

Type Values Removed Values Added
Title Brocade Fabric OS Command Injection via WebTools Configuration Operations

Thu, 08 Oct 2026 06:15:00 +0000

Type Values Removed Values Added
Title Brocade Fabric OS Command Injection via WebTools Configuration Operations

Thu, 08 Oct 2026 05:45:00 +0000

Type Values Removed Values Added
First Time appeared Brocade
Brocade fabric Os
Vendors & Products Brocade
Brocade fabric Os

Thu, 08 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
Description A command injection vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operations of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user with permissions to perform configuration downloads using remote server profiles can supply malicious parameter strings to execute arbitrary shell commands on the switch with root privileges
Weaknesses CWE-78
References
Metrics cvssV4_0

{'score': 8.5, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Broadcom Fabric Operating System
Brocade Fabric Os
cve-icon MITRE

Status: PUBLISHED

Assigner: brocade

Published:

Updated: 2026-10-09T03:55:33.147Z

Reserved: 2026-09-21T20:30:21.087Z

Link: CVE-2026-94586

cve-icon Vulnrichment

Updated: 2026-10-08T15:18:54.686Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-08T05:17:06.660

Modified: 2026-10-14T19:36:00.183

Link: CVE-2026-94586

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-08T19:45:07Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')