---
id: CVE-2026-87677
title: >-
  An OS command injection vulnerability exists in the account management
  subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through
  10.0.0a1
summary: >-
  An OS command injection vulnerability exists in the account management
  subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through
  10.0.0a1. When an administrator initiates an account deletion, the system
  invokes an internal…
severity: medium
cvss: 6.6
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-78
vendor: broadcom
product: fabric_operating_system
affected:
  - fabric_operating_system < 9.2.2d
  - 'fabric_operating_system >= 10.0.0, < 10.0.1'
patched:
  - fabric_operating_system 10.0.1
published: '2026-10-08'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T19:33:34.947'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-87677'
references:
  - url: 'https://support.broadcom.com/external/content/SecurityAdvisories/0/39131'
    label: sirt@brocade.com
tags:
  - nvd
  - cve.org
epss: 0.0061
epssPercentile: 0.48998
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-08T15:18:52.042361Z'
scores:
  nvd: 6.6
  cna: 5.4
ingestedAt: '2026-10-08T05:05:36.680Z'
---

## Overview

An OS command injection vulnerability exists in the account management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When an administrator initiates an account deletion, the system invokes an internal maintenance routine to clean up cryptographic keys associated with the target account. Malformed account names previously accepted by Fabric OS can cause the execution of embedded shell metacharacters, triggering command injection.

## Affected

- `fabric_operating_system < 9.2.2d`
- `fabric_operating_system >= 10.0.0, < 10.0.1`

## Remediation

Upgrade past the affected range:

- `fabric_operating_system 10.0.1`