CVE-2026-87673: An OS command injection vulnerability exists in maintenance command-line diagnostic utilities on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 | LiveThreat CVE Feed — Verisq

Login Request a demo

High severity · published Oct 8, 2026

CVE-2026-87673

An OS command injection vulnerability exists in maintenance command-line diagnostic utilities on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1

7.2

CVSS

1.8%

EPSS

No

On KEV

Description

An OS command injection vulnerability exists in maintenance command-line diagnostic utilities on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. The binary fails to sanitize user-supplied input options when invoking underlying system commands through a shell interpreter. A privileged user with maintenance account access can exploit this issue by supplying crafted parameters, which results in arbitrary OS command execution with root privileges.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

High

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)1.8% · higher than 78% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

FO

Fabric OS · Brocade

before 9.2.2d; 10.0.0 through 10.0.0a1 · source: vendor

FO

Fabric Operating System · Broadcom

before 9.2.2d; 10.0.0 before 10.0.1 · source: NVD

Affected product

FO

Fabric OS

Brocade

All Fabric OS CVEs

References

https://nvd.nist.gov/vuln/detail/CVE-2026-87673

https://www.cve.org/CVERecord?id=CVE-2026-87673

support.broadcom.com

https://support.broadcom.com/external/content/SecurityAdvisories/0/39144

More from Fabric OS

6.7

Code injection exposure in Fabric OS 9.1.0 through 9.1.1d6

9.8

A critical authorization bypass vulnerability exists in the Management Server handling of Brocade Fabric OS versions before 10.0.1

9.8

A stack-based buffer overflow vulnerability exists in the SNMP daemon request handling of Brocade Fabric versions before 10.0.1

8.8

An authentication bypass vulnerability exists in the web management interface of Brocade Fabric OS versions before 9.2.2d running on the MXG610 platform

8.8

Brocade Fabric OS versions before 10.0.1 contain an authorization logic vulnerability in the AAA (Authentication, Authorization, and Accounting) integration framework allows…