---
id: CVE-2026-87662
title: >-
  Brocade Fabric versions before 9.2.2d and 10.0.0 through 10.0.0a1 handling of
  specific download protocols utilizes unsanitized parameter strings
summary: >-
  Brocade Fabric versions before 9.2.2d and 10.0.0 through 10.0.0a1 handling of
  specific download protocols utilizes unsanitized parameter strings. When
  processing upgrade requests, parameters are converted into system command
  strings and …
severity: medium
cvss: 6.7
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-78
vendor: broadcom
product: fabric_operating_system
affected:
  - fabric_operating_system < 9.2.2d
  - 'fabric_operating_system >= 10.0.0, < 10.0.1'
patched:
  - fabric_operating_system 10.0.1
published: '2026-10-08'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T19:32:30.480'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-87662'
references:
  - url: 'https://support.broadcom.com/external/content/SecurityAdvisories/0/39162'
    label: sirt@brocade.com
tags:
  - nvd
  - cve.org
epss: 0.00253
epssPercentile: 0.16732
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-08T15:19:00.618256Z'
scores:
  nvd: 6.7
  cna: 7
ingestedAt: '2026-10-08T05:05:36.681Z'
---

## Overview

Brocade Fabric versions before 9.2.2d and 10.0.0 through 10.0.0a1 handling of specific download protocols utilizes unsanitized parameter strings. When processing upgrade requests, parameters are converted into system command strings and executed through a system shell interface. Because control characters and shell metacharacters in fields like the host or file path are not stripped or sanitized, an attacker can execute arbitrary shell commands with the firmware management daemon's elevated privileges.

## Affected

- `fabric_operating_system < 9.2.2d`
- `fabric_operating_system >= 10.0.0, < 10.0.1`

## Remediation

Upgrade past the affected range:

- `fabric_operating_system 10.0.1`