CVE-2026-87677CWE-78command-injection

CVE-2026-87677

Medium · published October 8, 2026

CVSS v3.1
6.6
EPSS
1%
Percentile
48.5
In the wild
Unconfirmed
What it is

An OS command injection vulnerability exists in the account management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When an administrator initiates an account deletion, the system invokes an internal maintenance routine to clean up cryptographic keys associated with the target account. Malformed account names previously accepted by Fabric OS can cause the execution of embedded shell metacharacters, triggering command injection.

The record
Technical detail
CVSS v3.1
6.6 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
5.4 · CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00610 · 48.5th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-10-08T09:17Z
Affected products (2)
ProductVersionsFixed in
broadcom/fabric_operating_system< 9.2.2d9.2.2d
broadcom/fabric_operating_system≥ 10.0.0, < 10.0.110.0.1
References (1)
https://support.broadcom.com/external/content/SecurityAdvisories/0/39131 · [email protected]
EPSS history
Timeline
  • 09 OCT 03:32Z
    EPSS moved — → 1%
    epss
  • 08 OCT 04:25Z
    An OS command injection vulnerability exists in the account management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1
    cvelistv5
  • 08 OCT 04:25Z
    An OS command injection vulnerability exists in the account management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1
    cvelistv5