CVE-2026-87667: CWE-88: Improper Neutralization of Argument Delimiters or Special Sequences in Commands ('Argument Injection') in Brocade Fabric OS

This vulnerability arises from improper neutralization of argument delimiters or special sequences in commands (CWE-88) within the configuration management CLI utility of Brocade Fabric OS. Specifically, when executing configuration viewing commands with search pattern filters, the utility fails to sanitize user input before passing it to internal search commands. This allows a low-privileged authenticated user to perform argument injection, leading to unauthorized reading of arbitrary files on the local operating system, including sensitive configuration files and password hashes. The affected versions are all releases before 9.2.2d and versions from 10.0.0 up to and including 10.0.0a1.

An attacker with low-privilege administrative access can exploit this vulnerability to read arbitrary files on the local system. This includes sensitive configuration files, system password hashes, and other system secrets, potentially leading to further compromise or information disclosure within the affected environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict low-privilege administrative access to trusted users only and monitor for suspicious command-line activity related to configuration viewing commands with search filters.