---
id: CVE-2026-87667
title: >-
  An argument injection vulnerability exists in the configuration management
  command-line utility of Brocade Fabric OS versions before 9.2.2d and 10.0.0
  through 10.0.0a1
summary: >-
  An argument injection vulnerability exists in the configuration management
  command-line utility of Brocade Fabric OS versions before 9.2.2d and 10.0.0
  through 10.0.0a1. When executing configuration viewing commands with search
  pattern fi…
severity: medium
cvss: 4.5
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-88
vendor: broadcom
product: fabric_operating_system
affected:
  - fabric_operating_system < 9.2.2d
  - 'fabric_operating_system >= 10.0.0, < 10.0.1'
patched:
  - fabric_operating_system 10.0.1
published: '2026-10-08'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T19:14:29.397'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-87667'
references:
  - url: 'https://support.broadcom.com/external/content/SecurityAdvisories/0/39151'
    label: sirt@brocade.com
tags:
  - nvd
  - cve.org
  - score-dispute
epss: 0.00185
epssPercentile: 0.08043
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-08T15:14:49.546921Z'
scores:
  nvd: 4.5
  cna: 8.4
ingestedAt: '2026-10-08T04:04:32.118Z'
---

## Overview

An argument injection vulnerability exists in the configuration management command-line utility of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When executing configuration viewing commands with search pattern filters, the utility fails to sanitize user-supplied search string options before passing them to internal search commands. An authenticated user with low-privilege administrative access can exploit this vulnerability to read arbitrary files on the local operating system, including sensitive configuration files, system password hashes and system secrets.

## Affected

- `fabric_operating_system < 9.2.2d`
- `fabric_operating_system >= 10.0.0, < 10.0.1`

## Remediation

Upgrade past the affected range:

- `fabric_operating_system 10.0.1`