CVE-2026-94581: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Brocade Fabric OS

CVE-2026-94581 is an OS command injection vulnerability in the REST API management interface of Brocade Fabric OS. It affects versions before 9.2.2d and versions 10.0.0 through 10.0.0a1. An attacker with administrative privileges can exploit this by providing malicious input containing shell metacharacters in the SSH known host configuration parameters, resulting in arbitrary command execution with root privileges on the host system.

Successful exploitation allows a remote attacker with high privileges to execute arbitrary system commands as root, potentially leading to full system compromise. The vulnerability requires authentication and administrative access to the REST API management interface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrative access to the REST API management interface and validate input parameters carefully to prevent injection of shell metacharacters.