An OS command injection vulnerability exists in the PAM (Pluggable Authentication Module) session cleanup routines during SSH session termination on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user authenticating via an external directory or AAA service whose username or profile identifier contains shell metacharacters can trigger arbitrary command execution with root privileges when their remote SSH session closes.
Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 directly accepts Apache configuration file data during service setup or re-initialization. An attacker capable of corrupting the configuration structure will prevent the web management service from starting or recovering during service bring-up, leading to a persistent Denial of Service (DoS) of the administrative web interface.
An OS command injection vulnerability exists in the account management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When an administrator initiates an account deletion, the system invokes an internal maintenance routine to clean up cryptographic keys associated with the target account. Malformed account names previously accepted by Fabric OS can cause the execution of embedded shell metacharacters, triggering command injection.
CVE-2026-94586 is a command injection vulnerability in the WebTools administrative interface of Brocade Fabric OS. It affects versions before 9.2.2d and versions 10.0.0 through 10.0.0a1. An authenticated user with configuration download permissions can exploit this flaw to execute arbitrary shell commands with root privileges on the switch. The vulnerability has a high severity rating with a CVSS score of 8.5.
CVE-2026-94581 is an OS command injection vulnerability in the REST API management interface of Brocade Fabric OS. It affects versions before 9.2.2d and versions 10.0.0 through 10.0.0a1. An authenticated attacker with high privileges who can configure SSH known host settings may execute arbitrary system commands with root permissions by supplying crafted parameters containing shell metacharacters.
CVE-2026-94577 is a privilege escalation vulnerability in Brocade Fabric OS affecting versions before 9.2.2d and 10.0.0 through 10.0.0a1. It involves improper authorization handling in the internal CLI, allowing an authenticated user or local process to bypass RBAC checks and gain root privileges.
CVE-2026-87664 is a high-severity vulnerability in Brocade Fabric OS affecting versions prior to 9.2.2d and versions 10.0.0 through 10.0.0a1. It involves a session context forgery in the web management daemon where local IPC storage callbacks are accepted without verifying the sender's identity. This allows attackers to gain elevated administrative privileges on the web management interface without proper authentication.
CVE-2026-87663 is an authentication bypass and command injection vulnerability in Brocade Fabric OS. It affects versions before 9.2.2d and versions 10.0.0 through 10.0.0a1. The flaw exists in the inter-switch remote execution service, where commands received from fabric-connected switches are processed with elevated privileges without proper parameter verification. This allows an attacker on a connected switch to escalate privileges and execute arbitrary root commands locally or on other managed fabric members with remote execution enabled.
CVE-2026-87662 is an OS command injection vulnerability in Brocade Fabric OS. It affects versions before 9.2.2d and versions 10.0.0 through 10.0.0a1. The flaw arises from unsanitized parameter strings used in processing upgrade requests, allowing attackers to execute arbitrary shell commands with elevated privileges of the firmware management daemon.
An argument injection vulnerability exists in the configuration management command-line utility of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When executing configuration viewing commands with search pattern filters, the utility fails to sanitize user-supplied search string options before passing them to internal search commands. An authenticated user with low-privilege administrative access can exploit this vulnerability to read arbitrary files on the local operating system, including sensitive configuration files, system password hashes and system secrets.
CVE-2026-87666 is an OS command injection vulnerability in Brocade Fabric OS affecting versions before 9.2.2d and versions 10.0.0 through 10.0.0a1. It occurs in the time and zone management subsystem when updating system timezone settings via the REST API or configuration download routines. The system fails to properly sanitize input, allowing an authenticated low-privilege administrative user to execute arbitrary shell commands with elevated privileges by submitting crafted timezone strings containing shell metacharacters.
CVE-2026-87675 is an OS command injection vulnerability in Brocade Fabric OS affecting versions before 9.2.2d and from 10.0.0 through 10.0.0a1. It occurs in the configuration management subsystem during configuration download operations, where user-supplied input is passed unsanitized to an internal utility script. This allows execution of arbitrary OS commands on the affected switch when an administrator initiates the configuration download.
CVE-2026-87674 is a local privilege escalation vulnerability in Brocade Fabric OS affecting versions before 9.2.2d and from 10.0.0 through 10.0.0a1. The flaw arises from insufficient access controls on internal IPC channels in the system logging daemon, allowing unprivileged local users to submit malformed logging configurations. Improper input sanitization during configuration file generation enables injection of arbitrary directives that execute with elevated privileges when the logging service reloads.
CVE-2026-87673 is an OS command injection vulnerability in Brocade Fabric OS maintenance command-line diagnostic utilities. It affects versions before 9.2.2d and versions 10.0.0 through 10.0.0a1. The vulnerability arises because the binary does not properly sanitize user input when invoking system commands via a shell interpreter. A privileged user with maintenance account access can exploit this flaw to execute arbitrary OS commands with root privileges.
CVE-2026-87687 is a high-severity vulnerability in Brocade Fabric OS that affects versions before 9.2.2d and versions 10.0.0 through 10.0.0a1. It allows an authenticated user with restricted privileges in one Virtual Fabric to exploit improper input validation by submitting a specially crafted request with an arbitrary fabric identifier. This leads to unauthorized cross-fabric operations and unauthorized viewing of configuration details in other Virtual Fabrics or tenants.
CVE-2026-87685 is an arbitrary file manipulation vulnerability in the WebTools management interface of Brocade Fabric OS. It affects versions before 9.2.2d and versions 10.0.0 through 10.0.0a1. An authenticated administrative user can exploit this by submitting a crafted status file path parameter, causing arbitrary system files to be moved to a world-readable temporary directory. This can result in persistent denial of service, critical system file destruction, host compromise, or sensitive data leakage.
CVE-2026-87688 is a command injection vulnerability in the Brocade Fabric OS administrative management API's certificate management component. It occurs due to insufficient input sanitization of user-supplied certificate identifiers during certificate deletion operations. An authenticated attacker with certificate deletion privileges can exploit this flaw to execute arbitrary system commands with the management daemon's privileges. This affects Fabric OS versions before 9.2.2d and versions 10.0.0 through 10.0.0a1. The vulnerability has a high severity score of 8.5 CVSS v4.0.
A race condition and thread-safety vulnerability exists in the web management daemon of Brocade Fabric OS versions before 10.0.1. When handling user authentication requests across a multi-threaded execution pool, this race condition causes PAM modules to process stale or incorrect client IP addresses and switch context numbers. This leads to inaccurate audit records and potential access control bypasses where AAA evaluation or Calling-Station-ID ACL policies rely on client IP attributes.
An arbitrary file and directory deletion vulnerability exists in the REST API management interface handling USB storage operations on Brocade Fabric OS versions before 10.0.1. An authenticated user possessing USB management privileges can manipulate requested target paths to delete arbitrary files or directories on the switch's local root filesystem, bypassing intended USB mount point boundaries.
A logic vulnerability exists in Brocade Fabric OS web management framework versions before 10.0.1. It allows an authenticated user with low privileges to bypass internal Role-Based Access Control (RBAC) checks under certain conditions. Exploiting this flaw lowers the authorization level of the active session, granting access to configuration settings normally restricted to administrators.