Broadcom Fabric OS: Command injection in REST API management interface
Summary
A command injection vulnerability in the REST API management interface of Brocade Fabric OS before 10.0.1 allows an authenticated user to run arbitrary system commands via crafted input parameters. Because the REST API is enabled by default, SAN switches running affected versions expose this attack surface on the management network. The CVSS 4.0 score is 8.5 (High); the attacker needs valid low-privilege credentials and no user interaction. Exploitation is not known.
Affected
- Brocade Fabric OS versions before 10.0.1 (per CNA record, all versions below 10.0.1)
- 9.2.x installations should be treated as potentially affected until Broadcom's advisory confirms otherwise
- Note: the separate CVE-2026-94581 has a different fixed release and must be checked separately
Fixed in
- Fabric OS 10.0.1 (Broadcom notification lists CVE-2026-87680 as addressed)
- Fixed versions for other branches: Unknown. Check Broadcom advisory SA 39074.
Workaround
- Unknown. No vendor workaround was verified; check advisory 39074.
- Interim measure (not vendor-confirmed): restrict REST API access to a management VLAN or jump host and limit accounts with API access.
Exploitation
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- Not listed in CISA KEV; EPSS about 1%.
- No public proof-of-concept or exploitation reports found as of this writing.
Our recommendation
- Read Broadcom advisory SA 39074 and confirm the fixed version for each installed branch.
- Upgrade affected SAN switches to Fabric OS 10.0.1 or the fix listed for your branch.
- Until patched, restrict REST API access to trusted management hosts and review accounts with API access.
- HPE-branded SAN switches: also check the HPE bulletin for this issue.
- Monitor the CISA KEV catalogue for changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Broadcom Security Advisory SA 39074 support.broadcom.com
- Broadcom notification (FOS 10.0.1 fixes) support.broadcom.com
- FOS REST API documentation (Broadcom TechDocs) techdocs.broadcom.com
- Broadcom Fabric OS Security Users Guide docs.broadcom.com
- CVE record via OpenCVE (CISA SSVC, KEV status) app.opencve.io
- Rapid7 vulners record vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:14.
Original description (NVD)
A command injection vulnerability in the REST API management interface of Brocade Fabric OS versions before 10.0.1 allows an authenticated user to execute arbitrary system commands via crafted input parameters.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.