Fabric OS: Arbitrary file read via argument injection in configuration utility
Summary
An argument injection flaw (CWE-88) in the configuration management command-line utility of Brocade Fabric OS lets an authenticated administrator read arbitrary files on the switch operating system. Config-viewing commands with search filters do not sanitize the search string before passing it to internal tools. Exposed data can include configuration files, system password hashes and system secrets, which may enable lateral movement. Exploitation requires an admin account and network access to the management interface.
Affected
- Brocade Fabric OS versions before 9.2.2d
- Brocade Fabric OS versions 10.0.0 through 10.0.0a1
Fixed in
- Fabric OS 9.2.2d (9.2.x line)
- Fabric OS 10.0.1 (10.0.x line, per the CNA record and a sibling Broadcom bulletin)
- Exact 10.0.x fix for this CVE: confirm in Broadcom advisory 39151
Workaround
- Unknown. No vendor workaround has been identified.
- Interim measure (not from the vendor): restrict which administrative accounts can log in to the switch management interface and keep management access on a restricted network segment.
Exploitation
- Not listed in CISA KEV. CISA SSVC rates exploitation as none and automatable as no.
- VulDB reports no publicly available exploit and unknown technical details.
- Conflict: some VulDB wording calls exploitation easy and remote. This conflicts with the CVSS vector (adjacent network, high privileges) and the advisory, so it is not treated as reliable.
Our recommendation
- Inventory all Fabric OS switches and identify those running affected versions.
- Patch to 9.2.2d or the fixed 10.0.x release listed in advisory 39151 during the next maintenance window.
- Audit administrative accounts now and remove unneeded ones; rotate credentials that may have been exposed.
- Keep switch management interfaces off the internet and on a restricted management network.
- Monitor logins to the switch management interface for unusual administrative activity.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Broadcom Security Advisory 39151 support.broadcom.com
- CNA record via Vulners (CVELIST) vulners.com
- VulDB entry 415247 vuldb.com
- Broadcom sibling bulletin 39079 (CVE-2026-87685) support.broadcom.com
- Strix CVE summary www.strix.ai
- CVE-2025-1976 context (The Hacker News) thehackernews.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 12:45.
Original description (NVD)
An argument injection vulnerability exists in the configuration management command-line utility of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When executing configuration viewing commands with search pattern filters, the utility fails to sanitize user-supplied search string options before passing them to internal search commands. An authenticated user with low-privilege administrative access can exploit this vulnerability to read arbitrary files on the local operating system, including sensitive configuration files, system password hashes and system secrets.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.