---
id: CVE-2026-87682
title: >-
  Multiple OS Command Injection vulnerabilities exist in the management
  interface and session processing routines of Brocade Fabric OS versions before
  10.0.1
summary: >-
  Multiple OS Command Injection vulnerabilities exist in the management
  interface and session processing routines of Brocade Fabric OS versions before
  10.0.1. Input processing flaws during remote management connection validation
  and sessio…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-78
vendor: broadcom
product: fabric_operating_system
affected:
  - fabric_operating_system < 10.0.1
patched:
  - fabric_operating_system 10.0.1
published: '2026-10-08'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T17:27:59.653'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-87682'
references:
  - url: 'https://support.broadcom.com/external/content/SecurityAdvisories/0/39076'
    label: sirt@brocade.com
tags:
  - nvd
  - cve.org
epss: 0.01666
epssPercentile: 0.76627
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-08T12:58:00.730477Z'
scores:
  nvd: 8.8
  cna: 8.6
ingestedAt: '2026-10-08T02:02:29.011Z'
---

## Overview

Multiple OS Command Injection vulnerabilities exist in the management interface and session processing routines of Brocade Fabric OS versions before 10.0.1. Input processing flaws during remote management connection validation and session verification for directory-based user accounts allow untrusted input containing shell metacharacters to reach internal system execution wrappers. An authenticated user or a compromised directory service account can exploit these vulnerabilities to execute arbitrary operating system commands with elevated privileges on the target device.

## Affected

- `fabric_operating_system < 10.0.1`

## Remediation

Upgrade past the affected range:

- `fabric_operating_system 10.0.1`