Skip to content
Sign in
7.0 High

CVE-2026-87662 Brocade Fabric versions before 9.2.2d and 10.0.0 through 10.0.0a1 handling of specific download protocols utilizes…

Description

Brocade Fabric versions before 9.2.2d and 10.0.0 through 10.0.0a1 handling of specific download protocols utilizes unsanitized parameter strings. When processing upgrade requests, parameters are converted into system command strings and executed through a system shell interface. Because control characters and shell metacharacters in fields like the host or file path are not stripped or sanitized, an attacker can execute arbitrary shell commands with the firmware management daemon's elevated privileges.

Affected products and versions

Product Affected versions Fixed in
Fabric OS 10.0 10.0.0 → 10.0.0a1 No fix stated
Fabric OS 9.2 earliest → < 9.2.2d 9.2.2d

Other CVEs of Fabric OS

The 71 CVEs of Fabric OS →
CVE-2026-94585 An authentication bypass vulnerability exists in the web management interface of Brocade Fabric OS versions before… 7.7 High CVE-2026-94587 A buffer overflow vulnerability exists in the WebTools administrative interface handling configuration download or… 6.9 Medium CVE-2026-94579 An OS command injection vulnerability exists in the PAM (Pluggable Authentication Module) session cleanup routines… 5.4 Medium CVE-2026-94576 An authentication logic and privilege escalation vulnerability exists in the account management interface of Brocade… 5.9 Medium
Track this CVE