CVE-2026-87677: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Brocade Fabric OS

CVE-2026-87677 describes an OS command injection vulnerability in Brocade Fabric OS's account management subsystem. When an administrator deletes an account, the system runs a maintenance routine to remove cryptographic keys linked to that account. If the account name contains malformed input with embedded shell metacharacters, these can be executed, resulting in command injection. The affected versions are those before 9.2.2d and versions 10.0.0 through 10.0.0a1.

Successful exploitation could allow an attacker with administrative privileges to execute arbitrary OS commands via crafted account names during account deletion. This could lead to unauthorized system control or disruption of cryptographic key management. However, exploitation requires administrative privileges and user interaction (initiating account deletion).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, administrators should carefully validate account names and restrict account deletion operations to trusted personnel.