CVE-2026-87666: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Brocade Fabric OS

This vulnerability exists due to improper neutralization of special elements in the timezone string input processed by Brocade Fabric OS. Specifically, when an authenticated user with low-privilege administrative access submits a crafted timezone string containing shell metacharacters, the system executes these commands in the underlying shell environment without adequate sanitization. Affected versions are all Fabric OS versions prior to 9.2.2d and versions 10.0.0 through 10.0.0a1. The vulnerability allows privilege escalation by escaping the restricted management environment and executing arbitrary commands with elevated privileges.

Successful exploitation enables an authenticated low-privilege administrative user to execute arbitrary shell commands with elevated privileges on the affected system. This can lead to full system compromise, unauthorized access, and potential disruption of the Brocade Fabric OS environment. There are no known exploits in the wild as of the publication date.

No explicit patch or remediation information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict low-privilege administrative access and carefully validate inputs when updating timezone settings via the REST API or configuration downloads.