CVE-2026-82370CWE-77command-injection

CVE-2026-82370

published September 24, 2026

CVSS
8.6
EPSS
1%
Percentile
48.3
In the wild
Unconfirmed
What it is

Unauthenticated remote command injection in the Brocade SANnav orchestrator HTTP service permits network-adjacent attackers to execute arbitrary administrative switch CLI commands and issue container management instructions. This could allow an attacker to alter Fibre Channel fabric switch configurations or manipulate application container runtimes. This vulnerability affects Brocade SANnav versions before 3.0.1a.

The record
Technical detail
CVSS
8.6 · NONE
CVSS v4.0
8.6 · CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00605 · 48.3th percentile
Weakness
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published
2026-09-24T04:17Z
References (1)
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38995 · [email protected]
EPSS history
Timeline
  • 25 SEP 03:28Z
    EPSS moved — → 1%
    epss
  • 23 SEP 23:38Z
    Unauthenticated remote command injection in the Brocade SANnav orchestrator HTTP service
    cvelistv5