Skip to content
Sign in
8.5 High

CVE-2026-94581 An OS command injection vulnerability exists in the REST API management interface of Brocade Fabric OS versions before…

Description

An OS command injection vulnerability exists in the REST API management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 allows an authenticated, high-privileged remote attacker to execute arbitrary system commands with root permissions. An attacker with administrative privileges to configure SSH known host settings can supply specially crafted parameter values containing shell metacharacters to trigger command execution on the host system.

Affected products and versions

Product Affected versions Fixed in
Fabric OS 10.0 10.0.0 → 10.0.0a1 No fix stated
Fabric OS 9.2 earliest → < 9.2.2d 9.2.2d

Other CVEs of Fabric OS

The 71 CVEs of Fabric OS →
CVE-2026-94585 An authentication bypass vulnerability exists in the web management interface of Brocade Fabric OS versions before… 7.7 High CVE-2026-94587 A buffer overflow vulnerability exists in the WebTools administrative interface handling configuration download or… 6.9 Medium CVE-2026-94579 An OS command injection vulnerability exists in the PAM (Pluggable Authentication Module) session cleanup routines… 5.4 Medium CVE-2026-94576 An authentication logic and privilege escalation vulnerability exists in the account management interface of Brocade… 5.9 Medium
Track this CVE