CVE-2026-87662CWE-78command-injection

CVE-2026-87662

Medium · published October 8, 2026

CVSS v3.1
6.7
EPSS
0%
Percentile
15.9
In the wild
Unconfirmed
What it is

Brocade Fabric versions before 9.2.2d and 10.0.0 through 10.0.0a1 handling of specific download protocols utilizes unsanitized parameter strings. When processing upgrade requests, parameters are converted into system command strings and executed through a system shell interface. Because control characters and shell metacharacters in fields like the host or file path are not stripped or sanitized, an attacker can execute arbitrary shell commands with the firmware management daemon's elevated privileges.

The record
Technical detail
CVSS v3.1
6.7 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
7.0 · CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00253 · 15.9th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-10-08T09:17Z
Affected products (2)
ProductVersionsFixed in
broadcom/fabric_operating_system< 9.2.2d9.2.2d
broadcom/fabric_operating_system≥ 10.0.0, < 10.0.110.0.1
References (1)
https://support.broadcom.com/external/content/SecurityAdvisories/0/39162 · [email protected]
EPSS history
Timeline
  • 09 OCT 03:32Z
    EPSS moved — → 0%
    epss
  • 08 OCT 04:02Z
    Brocade Fabric versions before 9.2.2d and 10.0.0 through 10.0.0a1 handling of specific download protocols utilizes unsanitized parameter strings
    cvelistv5
  • 08 OCT 04:02Z
    Brocade Fabric versions before 9.2.2d and 10.0.0 through 10.0.0a1 handling of specific download protocols utilizes unsanitized parameter strings
    cvelistv5