CVE-2026-87682: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Brocade Fabric OS

Multiple OS Command Injection vulnerabilities exist in Brocade Fabric OS prior to version 10.0.1. These vulnerabilities stem from improper neutralization of special elements in input processed by the management interface and session routines, specifically during remote management connection validation and session verification for directory-based user accounts. This allows untrusted input containing shell metacharacters to reach internal system execution wrappers. Exploitation requires an authenticated user or a compromised directory service account and results in arbitrary OS command execution with elevated privileges on the affected device.

An attacker with valid authentication or control over a directory service account can execute arbitrary operating system commands with elevated privileges on the Brocade Fabric OS device. This could lead to full system compromise, unauthorized access, and potential disruption of network fabric operations.

A patch is available for this vulnerability. It is recommended to upgrade Brocade Fabric OS to version 10.0.1 or later to remediate the issue. Since this is a cloud-hosted service, the vendor manages remediation for the cloud environment; check the vendor advisory for confirmation and apply patches promptly in on-premises deployments.