---
id: CVE-2026-94581
title: >-
  An OS command injection vulnerability exists in the REST API management
  interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through
  10.0.0a1 allows an authenticated, high-privileged remote attacker to execute
  arbitrary syste…
summary: >-
  An OS command injection vulnerability exists in the REST API management
  interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through
  10.0.0a1 allows an authenticated, high-privileged remote attacker to execute
  arbitrary syste…
severity: medium
cvss: 6.8
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-78
vendor: broadcom
product: fabric_operating_system
affected:
  - fabric_operating_system < 9.2.2d
  - 'fabric_operating_system >= 10.0.0, < 10.0.1'
patched:
  - fabric_operating_system 10.0.1
published: '2026-10-08'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T19:35:26.330'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-94581'
references:
  - url: 'https://support.broadcom.com/external/content/SecurityAdvisories/0/39137'
    label: sirt@brocade.com
tags:
  - nvd
  - cve.org
epss: 0.01456
epssPercentile: 0.73357
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-08T15:18:55.333770Z'
scores:
  nvd: 6.8
  cna: 8.5
ingestedAt: '2026-10-08T05:05:36.680Z'
---

## Overview

An OS command injection vulnerability exists in the REST API management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 allows an authenticated, high-privileged remote attacker to execute arbitrary system commands with root permissions. An attacker with administrative privileges to configure SSH known host settings can supply specially crafted parameter values containing shell metacharacters to trigger command execution on the host system.

## Affected

- `fabric_operating_system < 9.2.2d`
- `fabric_operating_system >= 10.0.0, < 10.0.1`

## Remediation

Upgrade past the affected range:

- `fabric_operating_system 10.0.1`