CVE-2026-87677: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Brocade Fabric OS

This vulnerability involves improper neutralization of special elements in OS commands (CWE-78) within Brocade Fabric OS. Specifically, when an administrator deletes an account, the system executes a maintenance routine to remove cryptographic keys linked to that account. If the account name contains malicious shell metacharacters, these can be executed, leading to OS command injection. The affected versions are all releases prior to 9.2.2d and versions from 10.0.0 up to and including 10.0.0a1.

Successful exploitation allows an attacker with administrative privileges to execute arbitrary OS commands on the affected system during account deletion. This could lead to unauthorized system control or disruption of cryptographic key management. The CVSS 4.0 score is 5.4 (medium severity), reflecting the need for privileges and user interaction but high impact on confidentiality, integrity, and availability.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should exercise caution when deleting accounts and validate account names to avoid injection of shell metacharacters.