Brocade Fabric OS: OS command injection in management interface and session handling
Summary
Multiple OS command injection vulnerabilities in the management interface and session processing of Brocade Fabric OS before 10.0.1 allow shell metacharacters in input to reach internal execution wrappers. According to the CNA description, an authenticated user or a compromised directory-service account can run arbitrary operating system commands with elevated privileges on the switch. Exploitation requires adjacent network access, and the CVSS vector assumes low privileges and no user interaction. A conflicting third-party mirror claims unauthenticated access, so the authentication requirement must be verified against the vendor advisory.
Affected
- Brocade Fabric OS versions before 10.0.1 (per CNA and NVD range 0 to < 10.0.1)
- Hardware platform applicability: Unknown, check Broadcom advisory 39076
Fixed in
- Fabric OS 10.0.1 (per CNA record; verify platform applicability in Broadcom advisory 39076)
- Fabric OS 9.2.2d: Unknown, not confirmed for this CVE
Workaround
Unknown. No vendor-documented workaround was found. Restrict management and REST access to dedicated management networks and limit directory-service accounts to least privilege.
Exploitation
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total
- Not listed in CISA KEV; EPSS below 1%
- No public proof of concept or known in-the-wild exploitation found
Our recommendation
- Inventory all Fabric OS switches and directors, including HPE-branded units, and check HPE bulletin HPESBST05161 if applicable
- Confirm the fixed version per hardware model in Broadcom advisory 39076 and schedule the upgrade to 10.0.1 or the relevant branch
- Until patched, limit management-plane access to trusted admin hosts and review directory-service account privileges
- Verify the authentication requirement against the vendor advisory
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Broadcom Security Advisory 39076 support.broadcom.com
- Broadcom Security Advisory index 25000 support.broadcom.com
- Rapid7 via Vulners: CVE-2026-87682 vulners.com
- OpenCVE: CVE-2026-87682 app.opencve.io
- CIRCL via Vulners: CVE-2026-87682 vulners.com
- OffSeq Radar: CVE-2026-87682 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 09:11.
Original description (NVD)
Multiple OS Command Injection vulnerabilities exist in the management interface and session processing routines of Brocade Fabric OS versions before 10.0.1. Input processing flaws during remote management connection validation and session verification for directory-based user accounts allow untrusted input containing shell metacharacters to reach internal system execution wrappers. An authenticated user or a compromised directory service account can exploit these vulnerabilities to execute arbitrary operating system commands with elevated privileges on the target device.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.