What’s Vulnerable › Vulnerabilities
CVE-2026-87662
- Severity: medium (CVSS 6.7 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-08 · updated 2026-10-14
- Weakness: CWE-78
Description
Brocade Fabric versions before 9.2.2d and 10.0.0 through 10.0.0a1 handling of specific download protocols utilizes unsanitized parameter strings. When processing upgrade requests, parameters are converted into system command strings and executed through a system shell interface. Because control characters and shell metacharacters in fields like the host or file path are not stripped or sanitized, an attacker can execute arbitrary shell commands with the firmware management daemon's elevated privileges.
Affected products
- Brocade Fabric OS: before 9.2.2d; from 10.0.0 before 10.0.1 — fixed in 10.0.1, 9.2.2d
How to fix
Upgrade to a fixed version: Brocade Fabric OS 10.0.1, 9.2.2d. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-87662 or the next vulnerability affects your stack