CVE-2026-87673CWE-78command-injection

CVE-2026-87673

High · published October 8, 2026

CVSS v3.1
7.2
EPSS
2%
Percentile
78.2
In the wild
Unconfirmed
What it is

An OS command injection vulnerability exists in maintenance command-line diagnostic utilities on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. The binary fails to sanitize user-supplied input options when invoking underlying system commands through a shell interpreter. A privileged user with maintenance account access can exploit this issue by supplying crafted parameters, which results in arbitrary OS command execution with root privileges.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
7.0 · CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.01789 · 78.2th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-10-08T08:17Z
Affected products (2)
ProductVersionsFixed in
broadcom/fabric_operating_system< 9.2.2d9.2.2d
broadcom/fabric_operating_system≥ 10.0.0, < 10.0.110.0.1
References (1)
https://support.broadcom.com/external/content/SecurityAdvisories/0/39144 · [email protected]
EPSS history
Timeline
  • 09 OCT 03:32Z
    EPSS moved — → 1%
    epss
  • 08 OCT 03:29Z
    An OS command injection vulnerability exists in maintenance command-line diagnostic utilities on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through…
    cvelistv5
  • 08 OCT 03:29Z
    An OS command injection vulnerability exists in maintenance command-line diagnostic utilities on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through…
    cvelistv5