CVE-2026-87677

Executive Summary

CVE-2026-87677 is an OS command injection vulnerability (CWE-78) in the account management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When an administrator initiates an account deletion, the system invokes an internal maintenance routine to clean up cryptographic keys associated with the target account; malformed account names previously accepted by Fabric OS can cause embedded shell metacharacters to be executed. Successful exploitation allows arbitrary command execution on the affected switch in the context of the account-management maintenance routine, potentially compromising the storage area network (SAN) fabric.

Technical Analysis

The vulnerability resides in the account management subsystem of Brocade Fabric OS. According to the NVD description, account deletion triggers an internal maintenance routine responsible for cleaning up cryptographic keys associated with the target account. The flaw is a classic OS command injection (CWE-78): an account name that was previously accepted by Fabric OS can contain shell metacharacters, and when that account name is passed into the key-cleanup maintenance routine, the metacharacters are interpreted by the underlying shell rather than treated as inert data.

The attack surface is the administrative account-management workflow. The trigger condition is an administrator-initiated account deletion for an account whose name contains malformed or metacharacter-laden content. Because Fabric OS historically accepted these malformed account names, an attacker who can influence or pre-stage an account name — or who can persuade an administrator to delete an existing malformed account — can cause embedded shell metacharacters to execute. No public proof-of-concept, exploit code, or Nuclei template is available, and no CVSS score or vector was supplied by the data source, so this analysis is scoped strictly to the vulnerability class and the mechanism described in the NVD text.

The key preconditions are: (1) the target account name must contain shell metacharacters and must have been accepted by Fabric OS prior to the fix; (2) an account deletion must be initiated against that account. This is not an unauthenticated, remote pre-auth vulnerability; it requires interaction with the account management subsystem, typically by an authenticated administrator. However, the presence of a persistent malformed account name creates a stored, latent injection primitive that can be activated by a later, seemingly benign administrative action.

Exploitation Scenarios

Because no public PoC or exploit code exists, the following chain is described at the vulnerability-class level and is inferred from the NVD description and CWE-78.

1. Reconnaissance / target identification: The attacker identifies Brocade Fabric OS devices running affected versions (before 9.2.2d or 10.0.0 through 10.0.0a1). Management interfaces, including the account management subsystem, are typically reachable on the management network rather than the public internet, so the attacker first needs a foothold or access path to the management plane (for example, compromised admin credentials or a management VLAN position).

2. Triggering the flaw class: The attacker causes an account with a malformed name containing shell metacharacters to exist, or identifies an existing account whose name was previously accepted by Fabric OS and contains such characters. When an administrator initiates deletion of that account, the account-management subsystem invokes the internal maintenance routine that cleans up the account's cryptographic keys. The account name is processed by that routine without adequate sanitization, and the embedded shell metacharacters are interpreted by the shell — the defining behavior of OS command injection.

3. Payload / execution method: At the vulnerability-class level, the injected metacharacters cause the maintenance routine to execute unintended shell commands. The precise payload and execution method cannot be specified from the available description; no function names, endpoints, or parameters are provided in the source data and none should be assumed.

4. Post-exploitation impact: Successful command injection executes in the context of the account-management maintenance routine on the Fabric OS device. Given the device's role as a SAN fabric switch, this can enable further command execution, modification or exfiltration of fabric configuration and cryptographic material, disruption of zoning and fabric services, and potential lateral movement within the storage network. No public evidence of in-the-wild exploitation, CISA KEV listing, or threat actor campaign is associated with this CVE in the provided data.

Impact Assessment

The impact is potentially severe for organizations operating Brocade SAN fabrics. Command injection in the account management subsystem gives an attacker the ability to execute arbitrary operating-system commands on a fabric switch — a high-value control-plane device. The blast radius extends to any storage arrays, hosts, and fabric services that trust the compromised switch: zoning changes, fabric reconfiguration, and access to cryptographic key material associated with accounts could all be affected. Even though the trigger requires administrative account-deletion activity, the persistence of malformed account names means the injection primitive can lie dormant and be activated later by routine administration.

No CVSS score or vector was provided by the data source; the CVSS_VECTOR listed in METADATA is a notional estimate for an authenticated command-injection issue and should not be treated as vendor-assigned. EPSS is 0.00617 (48.0th percentile), indicating low near-term exploitation likelihood based on current public signals, and the CVE is not in CISA KEV. There is no public PoC or exploit code.

Detection Guidance

Sigma Rule

title: Brocade Fabric OS Account Deletion Command Injection Attempt
id: 7f3c9b21-4a6e-4d0f-9c2a-1b8e5d7f6a03
status: experimental
description: Detects account deletion or account creation events on Brocade Fabric OS with shell metacharacters embedded in the account name, consistent with CVE-2026-87677 command injection.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87677
author: valtersit.com
date: 2026-01-01
logsource:
  product: brocade
  service: fabric_os
detection:
  selection_delete:
    event.action|contains:
      - 'account delete'
      - 'userdelete'
      - 'accountdel'
  selection_meta:
    account.name|contains:
      - ';'
      - '|'
      - '&'
      - '`'
      - '$('
      - '${'
      - '>'
      - '<'
  condition: selection_delete and selection_meta
fields:
  - account.name
  - user.name
  - src_ip
falsepositives:
  - Legitimate account names containing unusual characters (should be rejected by policy)
level: high

YARA Rule

rule CVE_2026_87677_Brocade_FOS_Account_Injection
{
    meta:
        description = "Detects Brocade Fabric OS artifacts/log lines referencing malformed account names with shell metacharacters tied to CVE-2026-87677"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87677"
        date = "2026-01-01"
        cve = "CVE-2026-87677"

    strings:
        $del1 = "account" nocase
        $del2 = "delete" nocase
        $meta1 = ";"
        $meta2 = "$("
        $meta3 = "`"
        $meta4 = "${"
        $bin1 = "Fabric OS" nocase

    condition:
        uint16(0) == 0x213C or
        (any of ($del*) and any of ($meta*) and $bin1)
}

Suricata IDS Rule

alert tcp any any -> any 22 (msg:"CVE-2026-87677 Brocade Fabric OS account name shell metacharacter injection"; flow:established,to_server; content:"account"; nocase; content:"delete"; nocase; distance:0; pcre:"/(?:;|\||\$\(|`|\$\{)/"; classtype:attempted-admin; reference:cve,2026-87677; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-87677; sid:202687677; rev:1;)

Elastic Detection

sequence by host.id, user.name with maxspan=5m
  [ process where event.type == "start" and
      process.name : ("userdelete", "accountmgmt", "keymgr") and
      process.command_line : "*delete*" ]
  [ process where event.type == "start" and
      process.parent.name : ("userdelete", "accountmgmt", "keymgr") and
      process.command_line : ("*;*", "*|*", "*$(*", "*`*", "*${*") ]

Splunk SPL Query

index=brocade sourcetype=fabricos:audit "account" ("delete" OR "deleteaccount")
| search account_name IN ("*;*","*|*","*`*","*$(*","*${*","*>*","*<*")
| stats count min(_time) as first_seen max(_time) as last_seen by src, user, account_name, action
| convert ctime(first_seen) ctime(last_seen)
| sort - last_seen

Wazuh OSSEC Rule

<group name="brocade,fabricos,">
  <rule id="202687677" level="12">
    <decoded_as>brocade-fabricos</decoded_as>
    <field name="action">account delete|deleteaccount</field>
    <field name="account_name">.*[;|`]|\$\(|\$\{.*</field>
    <description>CVE-2026-87677: Possible Brocade Fabric OS command injection via malformed account name on deletion</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>command_injection,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 — UNPATCHED. No patch evidence was found in any tracked source, and no vendor fix version or workaround was provided. Treat any environment running the affected versions as exposed until a vendor advisory confirms remediation.

1. Immediate mitigations:

• Prevent creation of account names containing shell metacharacters (;, &, |, backticks, $(, ${, redirection characters). Enforce strict account-name validation at the management layer and audit existing accounts for malformed names.
• Avoid deleting any account whose name contains metacharacters until a fix is applied; where such accounts exist, coordinate with the vendor or perform deletion only under controlled conditions with monitoring.
• Restrict access to the Fabric OS management plane (SSH, management UI) to trusted administrative hosts on a dedicated management network; enforce strong authentication and least privilege.
• Increase audit logging of account management operations and alert on any account deletion involving unusual names.

2. Patch/upgrade steps:

• Monitor the Brocade (Broadcom) security advisory channel for a fixed Fabric OS release addressing CVE-2026-87677. Upgrade to the earliest version at or above the vendor-designated fix (affected ranges reported: before 9.2.2d and 10.0.0 through 10.0.0a1).
• Validate the fix by testing account deletion workflows in a lab before production rollout.

3. Long-term hardening:

• Implement input validation and output/command encoding for all account-related fields processed by internal maintenance routines.
• Segment SAN management traffic from general networks, centralize Fabric OS audit logs, and continuously monitor for command-injection indicators.
• Track EPSS and vendor advisories for this CVE and reassess risk if exploitation activity emerges.

References

1. NVD — CVE-2026-87677: https://nvd.nist.gov/vuln/detail/CVE-2026-87677
2. CWE-78 — Improper Neutralization of Special Elements used in an OS Command: https://cwe.mitre.org/data/definitions/78.html
3. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
4. Brocade/Broadcom Fabric OS security advisories (vendor advisory channel — verify current published guidance for fixed versions 9.2.2d and later).
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-87677 not listed as of this report). No public PoC, exploit code, or threat actor campaign was identified in the provided data.