CVE-2026-87688CWE-77command-injection

CVE-2026-87688

Medium · published October 8, 2026

CVSS v3.1
6.8
EPSS
0%
Percentile
2.4
In the wild
Unconfirmed
What it is

An input validation vulnerability exists in the security certificate management component of the Brocade Fabric OS administrative management API. When processing certificate management operations, user-supplied certificate identifiers are handled without adequate sanitization prior to execution in external system routines. An authenticated attacker with privileges to perform certificate deletion requests can leverage this flaw to execute arbitrary system commands with the privileges of the underlying management daemon. This vulnerability affects Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
8.5 · CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00130 · 2.4th percentile
Weakness
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published
2026-10-08T08:17Z
Affected products (2)
ProductVersionsFixed in
broadcom/fabric_operating_system< 9.2.2d9.2.2d
broadcom/fabric_operating_system≥ 10.0.0, < 10.0.110.0.1
References (1)
https://support.broadcom.com/external/content/SecurityAdvisories/0/39072 · [email protected]
EPSS history
Timeline
  • 09 OCT 03:32Z
    EPSS moved — → 0%
    epss
  • 08 OCT 03:20Z
    An input validation vulnerability exists in the security certificate management component of the Brocade Fabric OS administrative management API
    cvelistv5
  • 08 OCT 03:20Z
    An input validation vulnerability exists in the security certificate management component of the Brocade Fabric OS administrative management API
    cvelistv5