CVE-2026-87675 Command injection in Fabric OS
Attackers can execute arbitrary OS commands on Brocade switches via malicious configuration files during download operations, requiring administrator action.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-87675?
CVE-2026-87675 is a high-severity command injection vulnerability in Broadcom Fabric Operating System, published on 8 Oct 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
An OS command injection vulnerability exists in the configuration management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When performing a configuration download operation, the management daemon will relay configuration parameters, user-supplied relay host strings, and filenames directly to an internal utility script without sufficient character set validation. Because the local utility fails to sanitize shell metacharacters before processing them in a system shell command, a malicious or compromised configuration file can cause arbitrary operating system commands to be executed on a remote local switch when an administrator initiates a configuration download.
Weakness: CWE-78
Which versions are affected by CVE-2026-87675?
It affects 1 product.
Products include Broadcom Fabric Operating System.
How do I fix CVE-2026-87675?
No fix has been published for CVE-2026-87675 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-87675 being exploited?
There is no known exploitation of CVE-2026-87675 in the wild and no public exploit code.
Other vulnerabilities in Broadcom Fabric Operating System
Sources
Also known as GHSA-866x-57qx-q5cx.