Vulnerability Details CVE-2026-87675
An OS command injection vulnerability exists in the configuration management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When performing a configuration download operation, the management daemon will relay configuration parameters, user-supplied relay host strings, and filenames directly to an internal utility script without sufficient character set validation. Because the local utility fails to sanitize shell metacharacters before processing them in a system shell command, a malicious or compromised configuration file can cause arbitrary operating system commands to be executed on a remote local switch when an administrator initiates a configuration download.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.007
EPSS Ranking 53.3%
CVSS Severity
CVSS v3 Score 6.8
Products affected by CVE-2026-87675
-
cpe:2.3:o:broadcom:fabric_operating_system:10.0.0
-
cpe:2.3:o:broadcom:fabric_operating_system:10.0.0a1