Brocade Fabric OS: OS command injection via timezone settings
Summary
Brocade Fabric OS, the operating system of Brocade Fibre Channel SAN switches, contains an OS command injection flaw in its time zone management. An authenticated administrator with low privileges can submit a crafted time zone string through the REST API or configuration download routines. Successful exploitation allows arbitrary shell commands with elevated privileges and can escape the restricted management environment.
Affected
- Brocade Fabric OS before 9.2.2d
- Brocade Fabric OS 10.0.0 through 10.0.0a1
- Other affected builds: Unknown.
Fixed in
- Brocade Fabric OS 9.2.2d and 10.0.1 (according to Broadcom's batch listing; the exact fixed build per platform is Unknown until advisory 39149 is checked).
Workaround
- No vendor workaround known. Unknown until Broadcom advisory 39149 is read.
- Interim: restrict switch management interfaces (REST, web, SSH) to a dedicated management VLAN and named admin hosts.
- Interim: review which accounts hold admin rights and remove unneeded ones.
Exploitation
- No evidence of exploitation in the wild found. Not listed as known exploited (KEV: No in one tracker).
- No public proof-of-concept found.
- EPSS about 0.026 in one snapshot (low).
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Check whether Brocade Fabric OS switches run a version before 9.2.2d or 10.0.0 through 10.0.0a1.
- Plan the upgrade to the fixed release from advisory 39149 in the next maintenance window; patch the whole batch of related Fabric OS flaws together.
- Until patched, restrict management access to a dedicated VLAN and named admin hosts, and enforce strong, non-shared admin credentials.
- Log and review time zone and configuration changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Broadcom Security Advisory 39149 support.broadcom.com
- Broadcom batch listing (FOS 10.0.1 and 9.2.2d) support.broadcom.com
- CIRCL/Vulners listing CVE-2026-87666 vulners.com
- CVE record mirror (CVELIST) vulners.com
- ThreatInt CVE mirror cve.threatint.com
- VulDB CVE-2026-87666 vuldb.com
- Strix CVE-2026-87666 (KEV and EPSS status) www.strix.ai
- SecNews write-up on Fabric OS batch www.secnews.gr
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 09:11.
Original description (NVD)
An OS command injection vulnerability exists in the time and zone management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When updating system timezone settings via the REST API or configuration download routines, the system fails to sanitize input values before processing them in underlying shell execution routines. An authenticated user with low-privilege administrative access can exploit this vulnerability by submitting a crafted timezone string containing shell metacharacters. Successful exploitation allows the attacker to escape the restricted management environment and execute arbitrary shell commands with elevated privileges.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.