An OS command injection vulnerability exists in the time and zone management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0… (CVE-2026-87666)

CVE-2026-87666 is an OS command injection vulnerability in Brocade Fabric OS affecting versions prior to 9.2.2d and from 10.0.0 up to 10.0.0a1. The vulnerability arises because the system does not sanitize input values when updating system timezone settings through the REST API or configuration download routines. An attacker with low-privilege administrative access can exploit this by injecting shell metacharacters in the timezone string, enabling arbitrary command execution with elevated privileges.

Successful exploitation allows an authenticated low-privilege administrative user to escape the restricted management environment and execute arbitrary shell commands with elevated privileges, potentially leading to full system compromise or disruption of device operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, restrict access to the REST API and configuration management interfaces to trusted administrators only and monitor for suspicious activity related to timezone configuration changes.