CVE-2026-87675

Executive Summary

CVE-2026-87675 is an OS command injection vulnerability (CWE-78) in the configuration management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An administrator-initiated configuration download relays user-supplied relay host strings and filenames to an internal utility script that fails to sanitize shell metacharacters, allowing arbitrary OS command execution with the privileges of the management daemon. Successful exploitation yields full compromise of the affected switch, enabling lateral movement across the storage area network (SAN) fabric.

Technical Analysis

The vulnerability resides in the configuration management subsystem responsible for configuration download operations. The affected management daemon processes configuration parameters, including user-supplied relay host strings and filenames, and relays them to an internal utility script. This utility script fails to sanitize shell metacharacters before passing the values into a system shell command, resulting in OS command injection.

The attack surface is the configuration download workflow itself, which is necessarily privileged and typically restricted to administrators. Because a malicious or compromised configuration file can carry the injection payload, the trust boundary between the configuration file and the local utility script is violated: untrusted data from the configuration file is treated as trusted input by the shell. The lack of a sufficient character set allowlist on relay host strings and filenames is the root cause.

Per CWE-78, the impact is arbitrary OS command execution in the context of the management daemon. The NVD description states that commands are executed on the local switch when an administrator initiates a configuration download, and the phrase "on a remote local switch" indicates the executing host is the switch processing the download. No specific function names, script paths, or parameter names are disclosed in the available data, so the exact injection point and character set cannot be enumerated. The affected versions are Brocade Fabric OS before 9.2.2d and 10.0.0 through 10.0.0a1.

Exploitation Scenarios

No public PoC is available; the attack chain is inferred from the vulnerability class.

1. Reconnaissance/target identification: An adversary identifies Brocade Fabric OS switches whose version falls before 9.2.2d or within 10.0.0 through 10.0.0a1. Access to the management interface (or the ability to influence a configuration file consumed by it) is presumed.

2. Triggering the flaw: The attacker crafts or compromises a configuration file that includes injected shell metacharacters in a relay host string or filename. When an administrator initiates a configuration download, the management daemon relays these values to the internal utility script.

3. Payload/execution method: The utility script builds a system shell command using the unsanitized values. Shell metacharacters embedded in the relay host string or filename cause the shell to execute an attacker-chosen OS command on the local switch. The specific payload syntax is not documented; exploitation follows standard command-injection semantics.

4. Post-exploitation impact: With arbitrary command execution under the management daemon's privileges, the attacker can modify configuration, disable protections, exfiltrate credentials or fabric data, and pivot to other switches in the fabric. Because the operation is administrator-initiated, execution may occur with elevated trust and may evade casual review.

Impact Assessment

CVE-2026-87675 has no assigned CVSS score in the provided data. Applying a conservative CVSS:3.1 vector of AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H yields a high-severity rating (estimated 7.2). The PR:H reflects the requirement for administrative interaction (initiating a configuration download). Impact is high across confidentiality, integrity, and availability: full switch compromise enables configuration tampering, data exfiltration, and denial of service.

Business impact includes compromise of SAN fabric infrastructure, which may contain high-value data paths. Blast radius is significant in environments with multiple Brocade switches, since a compromised switch can be used for lateral movement. EPSS is 0.00733 (52.9th percentile), indicating low current exploitation likelihood but non-trivial risk. CISA KEV status is NO, and no public exploit or Nuclei template exists.

Detection Guidance

Sigma Rule

title: Brocade Fabric OS Configuration Download Command Injection
id: 7f4c1e2a-9b3d-4a21-8c5e-2d6f0b1a9e44
status: experimental
description: Detects suspicious shell metacharacters in configuration download parameters on Brocade Fabric OS
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87675
author: valtersit.com
date: 2026/01/01
logsource:
  product: brocade
  service: fabric_os
detection:
  selection:
    EventID:
      - 'config_download'
      - 'configDownload'
  keywords:
    - ';'
    - '|'
    - '`'
    - '$('
    - '&&'
    - '||'
  condition: selection and keywords
falsepositives:
  - Legitimate filenames or hostnames containing special characters (rare)
level: high

YARA Rule

rule CVE_2026_87675_Brocade_Command_Injection
{
    meta:
        description = "Detects command injection payloads in Brocade Fabric OS configuration files"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87675"
        date = "2026-01-01"
    strings:
        $meta1 = /[;&|`$()]{1}.*(wget|curl|nc|bash|sh|/bin\/)/
        $meta2 = "relay"
        $meta3 = "download"
        $shell = "$("
        $backtick = "`"
    condition:
        (2 of ($meta*)) and ($shell or $backtick)
}

Suricata IDS Rule

alert tcp any any -> any 22 (msg:"CVE-2026-87675 Brocade Fabric OS config download command injection attempt"; flow:to_server,established; content:"config"; nocase; content:"download"; nocase; pcre:"/([;&|`]|\$\()/"; reference:cve,2026-87675; classtype:attempted-admin; sid:202687675; rev:1;)

Elastic Detection

sequence by host.name
  [process where event.type == "start" and process.name in ("sshd","httpd","mgmtd")]
  [process where event.type == "start" and process.command_line regex~ ".*[;&|`].*" and process.parent.name != null]

Splunk SPL Query

index=network_or_syslog sourcetype="brocade:fabricos"
| search ("config*download*" OR "configDownload")
| regex _raw="[;&|`]|\$\("
| stats count values(_raw) by host, user
| where count > 0

Wazuh OSSEC Rule

<group name="brocade,fabric_os">
  <rule id="2026876" level="12">
    <decoded_as>json</decoded_as>
    <field name="event_type">config_download</field>
    <regex field="relay_host">.*[;&|`].*</regex>
    <description>CVE-2026-87675: Possible command injection in Brocade Fabric OS config download</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

• Restrict administrative access to the configuration management interface to trusted, monitored hosts.
• Treat all configuration files as untrusted; validate relay host strings and filenames against a strict allowlist before use, and never load configuration files from unknown sources.
• Monitor and alert on shell metacharacters (;, |, `, $(, &&, ||) in configuration download parameters and filenames.
• Apply least privilege to the management daemon account where feasible.

2. Patch/upgrade steps:

• No patch is confirmed by tracked sources. Monitor Brocade advisories for Fabric OS versions after 9.2.2d and after 10.0.0a1, and upgrade as soon as a vendor fix is published.
• Validate any vendor advisory against the exact fixed versions before deploying.

3. Long-term hardening:

• Enforce input validation and output encoding for all values passed from configuration files into shell commands; prefer parameterized execution over shell invocation.
• Segment management networks and SAN fabrics to limit lateral movement.
• Maintain configuration integrity controls and audit configuration download operations.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-87675
• CWE-78: https://cwe.mitre.org/data/definitions/78.html
• MITRE ATT&CK T1190: https://attack.mitre.org/techniques/T1190/
• Brocade Fabric OS security advisories (vendor): https://www.broadcom.com/support/fibre-channel-networking/security-advisories
• CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaign or exploit-in-the-wild evidence is available for CVE-2026-87675. CISA KEV status is NO; no public PoC, exploit code, or Nuclei template was identified.