Brocade Fabric OS: OS command injection in WebTools configuration download
Summary
Brocade Fabric OS switches contain an OS command injection flaw in the WebTools web management interface, in the configuration download and file transfer functions that use remote server profiles. An authenticated user with permission to run configuration downloads can inject shell commands, which run with root privileges on the switch. The attacker needs access to the switch management network (CVSS AV:A) and high privileges (PR:H).
Affected
- Brocade Fabric OS before 9.2.2d
- Brocade Fabric OS 10.0.0 through 10.0.0a1
- Per the vendor advisory copy, Brocade SANnav and Brocade ASCG are not affected.
- Per the CNA record, Fabric OS builds outside these ranges are unaffected. Exact affected build strings: Unknown.
Fixed in
- Brocade Fabric OS 9.2.2d
- Brocade Fabric OS 10.0.1
- Note: one mirror of the advisory lists the affected range inconsistently; confirm the exact ranges on the Broadcom advisory 39135.
Workaround
Unknown. No vendor-documented workaround was found. Upgrading is the primary fix.
Exploitation
- CISA SSVC assessment: exploitation none, not automatable, total technical impact.
- No evidence of exploitation in the wild found; no CISA KEV entry found.
- No public proof of concept found.
Our recommendation
- Identify all Fabric OS switches, for example with the version or firmwareshow commands, and compare them against the advisory.
- Update affected switches to Fabric OS 9.2.2d or 10.0.1. For OEM-branded switches (IBM, HPE), follow the OEM update path.
- Until patched, restrict management access to a dedicated management VLAN or jump host.
- Review which accounts may run configuration downloads and audit remote server profiles and their credentials.
- Monitor switch logs for unusual configuration download or file transfer activity.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Broadcom Security Advisory 39135 support.broadcom.com
- VulDB CVE-2026-94586 vuldb.com
- Rapid7 via Vulners CVE-2026-94586 vulners.com
- Advisory mirror (cve.imfht.com) cve.imfht.com
- Threat Intelligence CVE-2026-94586 cve.threatint.com
- Strix CVE-2026-94586 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:11.
Original description (NVD)
A command injection vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operations of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user with permissions to perform configuration downloads using remote server profiles can supply malicious parameter strings to execute arbitrary shell commands on the switch with root privileges
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.