Brocade Fabric OS: OS command injection in REST API management interface
Summary
Brocade Fabric OS, the operating system of Fibre Channel SAN switches, contains an OS command injection flaw (CWE-78) in the REST API management interface. An authenticated attacker with administrative rights who can set SSH known-host parameters can inject shell metacharacters and execute arbitrary system commands as root. Successful exploitation could give full control over the switch and disrupt storage access in the fabric.
Affected
- Brocade Fabric OS before 9.2.2d
- Brocade Fabric OS 10.0.0 through 10.0.0a1
- Other products such as Brocade SANnav and Brocade ASCO are not affected, according to a third-party mirror of the advisory.
Fixed in
- Fabric OS 9.2.2d
- Fabric OS 10.0.1 according to the official CVE record. A third-party mirror names 10.0.0.1, which is unverified and must be checked against the Broadcom advisory.
Workaround
Unknown. No vendor workaround is documented. Limiting access to the management interface and restricting administrative accounts reduces the risk until the patch is applied.
Exploitation
- No known exploitation in the wild found at the time of research. CISA KEV status not checked directly.
- No public proof of concept found.
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Check whether Brocade Fabric OS switches are in use and which version runs.
- Plan the upgrade to Fabric OS 9.2.2d or the vendor-confirmed 10.0.x fixed version, and verify the target version in the Broadcom advisory first.
- Restrict access to the management network and review administrative accounts and their privileges.
- Monitor logs of the management interface.
- Patch together with other Fabric OS CVEs fixed in the same release, such as CVE-2026-94586.
- HPE-branded switches: check HPE bulletin HPESBST05160 for their fixed versions.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Broadcom Security Advisory 39137 support.broadcom.com
- Broadcom support notification 25000 support.broadcom.com
- CVE List record (Vulners) vulners.com
- Rapid7 record (Vulners) vulners.com
- Advisory mirror (imfht) cve.imfht.com
- CVE threat intelligence (threatint) cve.threatint.com
- VulDB CVE-2026-94581 vuldb.com
- Strix CVE-2026-94581 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:11.
Original description (NVD)
An OS command injection vulnerability exists in the REST API management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 allows an authenticated, high-privileged remote attacker to execute arbitrary system commands with root permissions. An attacker with administrative privileges to configure SSH known host settings can supply specially crafted parameter values containing shell metacharacters to trigger command execution on the host system.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.