---
id: CVE-2026-94586
title: >-
  A command injection vulnerability exists in the WebTools administrative
  interface handling configuration download or file transfer operations of
  Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1
summary: >-
  A command injection vulnerability exists in the WebTools administrative
  interface handling configuration download or file transfer operations of
  Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An
  authenticated user …
severity: medium
cvss: 6.8
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-78
vendor: broadcom
product: fabric_operating_system
affected:
  - fabric_operating_system < 9.2.2d
  - 'fabric_operating_system >= 10.0.0, < 10.0.1'
patched:
  - fabric_operating_system 10.0.1
published: '2026-10-08'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T19:36:00.183'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-94586'
references:
  - url: 'https://support.broadcom.com/external/content/SecurityAdvisories/0/39135'
    label: sirt@brocade.com
tags:
  - nvd
  - cve.org
epss: 0.01441
epssPercentile: 0.73073
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-08T15:18:53.930353Z'
scores:
  nvd: 6.8
  cna: 8.5
ingestedAt: '2026-10-08T05:05:36.680Z'
---

## Overview

A command injection vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operations of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user with permissions to perform configuration downloads using remote server profiles can supply malicious parameter strings to execute arbitrary shell commands on the switch with root privileges

## Affected

- `fabric_operating_system < 9.2.2d`
- `fabric_operating_system >= 10.0.0, < 10.0.1`

## Remediation

Upgrade past the affected range:

- `fabric_operating_system 10.0.1`