CVE-2026-87666

Executive Summary

CVE-2026-87666 is an OS command injection vulnerability (CWE-78) in the time and timezone management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. The flaw is reachable via the REST API and configuration download routines, where timezone input is passed unsanitized into underlying shell execution routines. An authenticated low-privilege administrative user can inject shell metacharacters to escape the restricted management environment and execute arbitrary commands with elevated privileges, giving full compromise of the SAN fabric switch.

Technical Analysis

The vulnerability resides in the Fabric OS subsystem responsible for system time and timezone configuration. Per the NVD description, two distinct attack surfaces expose the same root cause:

1. REST API timezone update path — an authenticated caller submits a timezone value that is subsequently processed by underlying shell execution routines.
2. Configuration download routines — timezone values ingested through configuration import/download flows are similarly passed to shell execution without sanitization.

The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The system "fails to sanitize input values before processing them in underlying shell execution routines." This is the classic command-injection pattern: a user-controlled string is concatenated into a command line (for example, a timedatectl/tzset-style shell invocation or an equivalent internal timezone-setting command) rather than being passed as a validated, enumerated timezone identifier. Because the timezone field is expected to contain structured data (a zone string such as a region/city pair), a rigorous implementation would validate against a fixed allowlist. Instead, shell metacharacters — characters such as ;, |, &, $(), or backticks — survive validation and are interpreted by the shell.

Critically, the injection occurs inside a restricted management environment. The NVD description states that successful exploitation "allows the attacker to escape the restricted management environment and execute arbitrary shell commands with elevated privileges." This means the command injection yields a privilege boundary crossing: the input point requires only a low-privilege authenticated administrative account, but the resulting command execution runs at a higher privilege level (e.g., root-level shell on the switch). The elevated-privilege execution is the direct consequence of the shell process running under a more privileged context than the user who supplied the input.

No specific API endpoint path, parameter name, function name, or code snippet is disclosed in the available NVD description or CNA title. The CNA title is blank. Accordingly, the analysis above is confined to the vulnerability class and the mechanism explicitly described; no endpoint or parameter identifiers are asserted because none are provided in the source data.

Affected scope: Brocade Fabric OS before 9.2.2d, and the 10.0.0 through 10.0.0a1 range. The EPSS score is 0.01847 (78.4th percentile), indicating low near-term predicted exploitation probability relative to the broader CVE corpus, though the percentile placement is elevated because most CVEs have near-zero EPSS. No public PoC, exploit code, or Nuclei template is known. CVE-2026-87666 is not listed in CISA KEV.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the documented vulnerability class (OS command injection into shell execution routines) and the exposure surfaces named in the NVD description. No endpoint, parameter, or function names are invented; the steps operate at the vulnerability-class level.

1) Reconnaissance / target identification. An adversary identifies an exposed Brocade Fabric OS management interface. Fabric OS switches are frequently reachable on management VLANs, and the REST API and configuration-management surfaces are often exposed to administrative networks. Target identification can leverage Shodan-style queries (see Metadata) and inventory enumeration of SAN management addresses. Version fingerprinting against the affected ranges (< 9.2.2d; 10.0.0–10.0.0a1) establishes exploitability.

2) Prerequisite access. The attacker must hold a valid but low-privilege administrative account. This is a post-authentication vulnerability — the CVSS vector assumes network reachability (AV:N), low privileges (PR:L), no user interaction (UI:N). Credential sources include default/weak credentials, credential reuse, harvested service accounts, or a separate initial-access foothold. No authentication bypass is required beyond possessing a valid low-privilege account.

3) Triggering the flaw. The attacker submits a crafted timezone string containing shell metacharacters through one of the two named surfaces:

• the REST API timezone-setting operation, or
• a configuration download/import routine that carries a timezone value.

The injected value is not sanitized before it is handed to the underlying shell execution routine. The shell metacharacters cause the underlying routine to execute an attacker-supplied command in addition to (or instead of) the intended timezone-setting action.

4) Execution and escaping the restricted environment. Because the shell routine runs with elevated privileges, the injected command executes outside the constrained management shell context. The attacker "escapes the restricted management environment" and gains arbitrary shell command execution with elevated privileges — in practice, a privileged shell on the switch.

5) Post-exploitation impact. With elevated command execution on a SAN fabric switch, an attacker can manipulate the fabric: reconfigure zoning, disrupt or redirect storage traffic, alter time/NTP configuration, read or exfiltrate configuration data, pivot to other fabric members, and establish persistence by modifying startup configuration or deploying malicious scripts. The success of exploitation is not dependent on the attacker holding high privilege at the input point — the elevation happens as part of the vulnerability.

Impact Assessment

The impact is severe and affects the integrity, confidentiality, and availability of the SAN fabric control plane. Applying standard CVSS v3.1 subscores consistent with the described mechanism:

• Attack Vector (AV:N) — the REST API and configuration-download surfaces are network-reachable.
• Attack Complexity (AC:L) — no unusual conditions; input is directly supplied.
• Privileges Required (PR:L) — a low-privilege administrative account suffices.
• User Interaction (UI:N) — no victim interaction required.
• Scope (S:C) — the attacker escapes the restricted management environment, crossing a security/privilege boundary.
• Confidentiality (C:H) — arbitrary command execution enables reading switch configuration and data.
• Integrity (I:H) — arbitrary commands can alter fabric, zoning, and system configuration.
• Availability (A:H) — commands can disrupt or take down the switch/fabric.

Business impact. Brocade switches are core SAN infrastructure. Compromise of a fabric member can cascade to storage availability for attached hosts, databases, and virtualization platforms. A privileged shell on a fabric switch is a high-value position enabling storage-layer attacks, data theft, ransomware staging, and lateral movement into storage and backup networks. Given the restricted-environment escape, the vulnerability also undermines the switch's administrative segregation model.

Blast radius. Any deployment of Fabric OS in the affected version ranges that exposes the REST API or configuration-download functionality and permits low-privilege administrative accounts. Multi-switch fabrics amplify impact through fabric-wide membership.

EPSS is 0.01847 (78.4th percentile), i.e., low absolute near-term likelihood but non-trivial relative ranking; absence from CISA KEV and lack of public exploit tooling currently constrain broad opportunistic exploitation. The risk is skewed toward targeted actors who already hold management credentials.

Detection Guidance

Sigma Rule

title: Brocade Fabric OS Timezone Command Injection Attempt (CVE-2026-87666)
id: 7b3f1c2a-9d44-4e0b-8a51-2c6f0e9d1a77
status: experimental
description: Detects timezone values containing shell metacharacters submitted to Brocade Fabric OS management surfaces, consistent with CVE-2026-87666 command injection.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87666
author: valtersit.com
date: 2026/01/01
logsource:
  product: brocade
  service: fabric_os
detection:
  selection_metachars:
    timezone|contains:
      - ';'
      - '|'
      - '&'
      - '`'
      - '$('
      - '${'
      - '&&'
      - '||'
      - '>'
      - '<'
  selection_context:
    action|contains:
      - 'timezone'
      - 'timezone_set'
      - 'config'
  condition: selection_metachars and selection_context
fields:
  - user
  - src_ip
  - timezone
  - action
falsepositives:
  - Legitimate administrative tooling that uses unusual but valid quoting in timezone strings (rare; timezone identifiers should be alphanumeric/slash only)
level: high
tags:
  - attack.t1190
  - cwe.78

YARA Rule

rule CVE_2026_87666_Brocade_FabricOS_CmdInjection
{
    meta:
        description = "Detects artifacts referencing Brocade Fabric OS timezone command injection (CVE-2026-87666)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87666"
        date = "2026-01-01"
        cve = "CVE-2026-87666"

    strings:
        $tz = "timezone" ascii nocase wide
        $fos = "Fabric OS" ascii nocase wide
        $b1 = "CVE-2026-87666" ascii nocase
        $m1 = ";sh" ascii
        $m2 = ";/bin/" ascii
        $m3 = "$(" ascii
        $m4 = "`id`" ascii
        $m5 = ";curl" ascii
        $m6 = "|nc " ascii

    condition:
        uint16(0) != 0x5A4D and
        (
            ($fos and $tz and 1 of ($m1,$m2,$m3,$m4,$m5,$m6))
            or ($b1)
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-87666 Brocade Fabric OS Timezone Command Injection Attempt"; flow:established,to_server; http.method; content:"POST"; http.header; content:"Fabric"; http.request_body; content:"timezone"; nocase; http.request_body; pcre:"/(timezone[^\n]{0,40}?)(;|\||&&|\$\(|`)/iR"; reference:cve,CVE-2026-87666; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-87666; classtype:attempted-admin; sid:202687666; rev:1;)

Elastic Detection

sequence by user.name, source.ip with maxspan=5m
  [ authentication where event.action == "logon" and event.outcome == "success" ]
  [ any where
      (event.action : "timezone*" or event.category : "configuration" or event.action : "config*")
      and
      (brocade.timezone : ("*;*" or "*|*" or "*&*" or "*`*" or "*$(*" or "*${*"))
  ]

Splunk SPL Query

index=brocade_san (sourcetype=fabricos:rest OR sourcetype=fabricos:config OR sourcetype=fabricos:audit)
| eval tztimezone=coalesce(timezone, tz, cfg_timezone, request_body)
| where match(tztimezone, "(?i)(;|\||&&|\|\||`|\$\(|\$\{)")
| stats count min(_time) as first_seen max(_time) as last_seen values(tztimezone) as payload by src_ip user action
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="brocade,fabricos,web,">
  <rule id="2026766" level="12">
    <decoded_as>json</decoded_as>
    <field name="action">timezone</field>
    <regex type="pcre2">(?i)(;|\||&&|\|\||`|\$\(|\$\{)</regex>
    <field name="timezone">\.+</field>
    <description>CVE-2026-87666: Brocade Fabric OS timezone command injection attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>command_injection,cve_2026_87666,</group>
  </rule>

  <rule id="2026767" level="13">
    <if_sid>2026766</if_sid>
    <field name="action">timezone</field>
    <description>CVE-2026-87666: Successful timezone-based command injection - possible privileged shell execution on Fabric OS switch</description>
    <group>exploitation,cve_2026_87666,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The versions cited by NVD as non-vulnerable (9.2.2d and later, and releases after 10.0.0a1) should be treated as the target baseline for upgrade, but no independently verified vendor patch artifact is currently tracked.

1) Immediate mitigations (until upgrade).

• Restrict network access to the Fabric OS management plane. Ensure the REST API and configuration-download surfaces are reachable only from trusted administrative networks/VLANs, never from untrusted or general-purpose networks.
• Enforce least privilege: audit all accounts with administrative access and eliminate or tightly scope low-privilege administrative accounts, since PR:L is sufficient for exploitation. Disable unused accounts.
• Treat any successfully authenticated low-privilege admin as a potential exploitation vector — monitor timezone-setting operations closely (see Detection Guidance).
• Where feasible, disable or temporarily block the REST API and configuration-import functionality if not operationally required.
• Rotate credentials for all administrative accounts, especially those exposed to shared service accounts.

2) Patch / upgrade steps.

• Plan migration to Fabric OS 9.2.2d or a later 9.2.x release, or to a 10.x release after 10.0.0a1, per the affected-version ranges in the NVD description.
• Because no verified patch source is tracked (0/4), validate upgrade targets against the official Brocade (Broadcom) advisory and release notes before deployment, and verify the fixed build actually contains the timezone-input sanitization change.
• Stage upgrades during maintenance windows; SAN fabric upgrades may require coordinated, non-disruptive code activation across fabric members.

3) Long-term hardening.

• Adopt strict input validation for all management-plane fields that feed system commands; timezone values should be constrained to an enumerated allowlist of valid identifiers and never concatenated into shell strings. Push for this control via vendor engagement.
• Segment SAN management networks from general IT networks; require jump-host/bastion access with MFA for switch administration.
• Centralize and retain switch audit logs (REST API, configuration, and shell/audit logs) and forward to the SIEM; enable alerting on command-injection indicators.
• Maintain an accurate asset/version inventory of all Fabric OS devices to rapidly identify exposure to future Fabric OS CVEs.
• Integrate CVE monitoring with the vendor advisory feed and reassess patch status regularly, given the current absence of verified patch evidence.

References

• NVD — CVE-2026-87666: https://nvd.nist.gov/vuln/detail/CVE-2026-87666
• CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): https://cwe.mitre.org/data/definitions/78.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Brocade / Broadcom Fabric OS security advisories and release notes (verify affected-version and fixed-build guidance): https://www.broadcom.com/support/fibre-channel-networking/security-advisories
• FIRST EPSS — CVE-2026-87666 score lookup (EPSS 0.01847, 78.4th percentile): https://api.first.org/data/v1/epss?cve=CVE-2026-87666

Threat actor / exploit-in-the-wild status: No known threat actor campaigns, public PoC, exploit code, or Nuclei template are associated with CVE-2026-87666 at the time of writing. The CVE is not listed in CISA KEV. Exploitation is currently assessed as targeted rather than opportunistic, given the post-authentication (low-privilege) requirement and the absence of public tooling.