CVE-2026-87673: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Brocade Fabric OS

This vulnerability in Brocade Fabric OS occurs in maintenance command-line diagnostic utilities that fail to neutralize special elements in user-supplied input. Specifically, the affected binaries invoke system commands through a shell interpreter without proper input sanitization, allowing a privileged maintenance user to execute arbitrary OS commands as root. The affected versions are all releases prior to 9.2.2d and versions 10.0.0 through 10.0.0a1. The CVSS 4.0 score is 7, indicating high severity with local attack vector, low attack complexity, and required privileges of a high-level user with partial user interaction.

Exploitation allows a privileged maintenance user to execute arbitrary OS commands with root privileges, potentially compromising the entire system. This could lead to unauthorized system control, data manipulation, or disruption of services. However, exploitation requires maintenance account access, limiting the attack surface to authorized users with elevated privileges.

No explicit patch or remediation information is provided in the vendor advisory or input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict maintenance account access to trusted personnel only and monitor for suspicious command usage.