CVE-2026-87675: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Brocade Fabric OS

This vulnerability exists due to improper neutralization of special characters in shell commands within the configuration management subsystem of Brocade Fabric OS. Specifically, when an administrator performs a configuration download, user-supplied relay host strings and filenames are passed directly to an internal utility script without sufficient validation or sanitization of shell metacharacters. This flaw enables an attacker who can supply or modify configuration files to execute arbitrary operating system commands on the affected switch. The affected versions are all releases prior to 9.2.2d and versions 10.0.0 through 10.0.0a1.

Successful exploitation allows an attacker to execute arbitrary OS commands on the affected Brocade Fabric OS switch with the privileges of the management daemon. This could lead to unauthorized control over the device, potentially compromising the switch's integrity and availability. The CVSS 4.0 base score is 7.3 (high), reflecting network attack vector, low complexity, partial privileges required, and high impacts on confidentiality, integrity, and availability.

No explicit patch or remediation information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid using untrusted or modified configuration files during configuration download operations and restrict access to configuration management interfaces to trusted personnel only.