CVE-2026-87680

Executive Summary

CVE-2026-87680 is a command injection vulnerability (CWE-78) in the REST API management interface of Brocade Fabric OS versions prior to 10.0.1. An authenticated attacker can supply crafted input parameters to the REST API that are passed unsanitized to the underlying operating system, resulting in arbitrary command execution with the privileges of the management service. Because Fabric OS governs Storage Area Network (SAN) fabric switching, successful exploitation can compromise the confidentiality, integrity, and availability of the entire storage fabric — not just the individual switch.

Technical Analysis

The vulnerability class is OS command injection (CWE-78). In this class, an application accepts user-controllable input and incorporates it into a system command (shell, subprocess, or CLI invocation) without adequate neutralization of shell metacharacters or argument boundaries. The NVD description states the flaw resides in the REST API management interface of Brocade Fabric OS and is triggered via crafted input parameters. No specific endpoint path, parameter name, function, or code construct is disclosed in the available data, so the following analysis stays at the vulnerability-class level and does not assert implementation specifics.

Attack surface: The REST API management interface of Fabric OS is a network-exposed administrative service. It is reachable over the management network and is used for fabric configuration, zoning, switch administration, and telemetry. Authentication is required ("allows an authenticated user"), meaning the attacker must first hold valid credentials — which lowers the remote-exploitability bar only slightly, since administrative interfaces are frequently reachable from jump hosts, management VLANs, and, in misconfigured deployments, broader network segments.

Mechanism (class-level): When a web/API layer forwards client-supplied values into a shell or command invocation without sanitization, an attacker embeds command separators or substitution constructs so the operating system executes a second, attacker-controlled command. Typical injection primitives in this class include command chaining/separators, command substitution, and shell metacharacters. The exact delimiter set that Fabric OS's interface fails to filter cannot be confirmed from the provided data and should be validated by the vendor or through authorized testing.

The impact is elevated because the compromised component is not a generic web application but a storage-network control plane. Fabric OS administrative code typically runs with broad privileges on the switch's embedded Linux-based control processor, so command injection at this layer can translate directly into control of the switch's management plane and, from there, the fabric itself.

Data limitations: The CNA title field is empty, vendor/product was reported as Unknown/Unknown in the ingestion data (the product is identified as Brocade Fabric OS from the NVD description), no affected-version enumeration was supplied beyond "before 10.0.1," and no CVSS vector was provided by the source. The vector above is an analyst-derived estimate (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and should be treated as provisional; the authoritative score is N/A pending NVD enrichment.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is available for CVE-2026-87680 (PoC Status: None; Exploit Code: NO; Nuclei Template: NO). The attack chain below is inferred from the vulnerability class and the explicit facts in the NVD description (authenticated user, REST API management interface, crafted input parameters). It does not assert any specific endpoint, parameter, or payload string.

1. Reconnaissance / target identification. The attacker identifies reachable Brocade Fabric OS management interfaces, typically by scanning for the REST API management service on management VLANs or exposed management ports. Fabric OS deployments are commonly enumerated by management-plane fingerprinting (for example via Shodan queries for the product banner). The attacker confirms the Fabric OS version is below 10.0.1 from banner data, login pages, or version-returning API responses.

2. Authentication. Per the NVD description, the attacker must be an authenticated user. This may be achieved through legitimate administrative credentials, a compromised jump host, a service account, or credential reuse from earlier intrusions. The reconnaissance step therefore includes acquiring or harvesting a valid management credential.

3. Triggering the flaw (vulnerability class). Once authenticated, the attacker sends requests to the REST API management interface in which input parameters contain crafted values. Because the interface passes this input into a system command without sanitization (CWE-78), the crafted value is interpreted by the operating system as a command rather than as inert data. The precise injection delimiter, injectable parameter, and endpoint are not disclosed in the available data and must not be assumed; class-level primitives for OS command injection include command separators, command substitution, and pipeline characters.

4. Execution and post-exploitation impact. Successful injection executes arbitrary system commands on the switch's control processor with the privileges of the management service. Practical consequences include: reading and exfiltrating fabric configuration and zoning data; creating or altering admin accounts; modifying switch configuration to disrupt or redirect storage traffic; using the switch as a pivot point deeper into the management network; and installing persistence. Because Fabric OS switches enforce zoning and fabric segmentation, integrity loss here can cascade to every host and storage array connected to the fabric.

Impact Assessment

Per the NVD description, a successful exploit grants arbitrary system command execution to an authenticated user. Impacting the standard CIA triad:

• Confidentiality (estimated High): Arbitrary command execution on the switch exposes fabric configuration, zoning definitions, credentials, and potentially intercepted or redirected storage traffic metadata.
• Integrity (estimated High): An attacker can alter switch configuration, zoning, and administrative accounts, enabling traffic manipulation or fabric-level sabotage that is opaque to normal monitoring.
• Availability (estimated High): Fabric OS devices are single points of failure for their SAN segments. Command execution can disable ports, crash services, or reconfigure the fabric in ways that sever storage connectivity and halt dependent workloads.

Blast radius: The immediate target is one Fibre Channel switch. The realistic blast radius is the entire SAN fabric — every host, hypervisor, and storage array whose paths transit the compromised switch, plus any other switches in the same fabric reachable via the management plane. SAN outages are not contained to a single business application; they commonly take down databases, virtualization clusters, and their dependent services in parallel.

Exploitability context: EPSS is 0.01022 (62.3rd percentile of exploited CVEs), indicating a moderate-but-non-trivial probability of exploitation activity in the near term relative to the broader CVE corpus. CISA KEV: NO — there is no confirmed evidence of exploitation in the wild at the time of writing. The authentication prerequisite (PR:L in the estimated vector) is the primary barrier; nonetheless, administrative credentials are commonly obtainable and the value of fabric control makes the vulnerability attractive to targeted actors rather than opportunistic mass scanning.

Scoring note: No CVSS score or vector was provided by the source. The vector reported in METADATA is an analyst estimate and must not be cited as vendor-assigned. Treat both score and severity as provisional until NVD publishes enrichment.

Detection Guidance

The following rules are detection scaffolding for the vulnerability class (authenticated command injection into the Fabric OS REST API management interface). They intentionally avoid asserting undisclosed endpoint paths or parameter names; the request-side signals they target are generic to REST command injection and should be tuned against the actual Fabric OS API traffic in your environment.

Sigma Rule

title: Potential Command Injection Against Brocade Fabric OS REST API Management Interface
id: 4f2c1e6a-9b3d-4e77-a1c2-8d5e0f7a6b91
status: experimental
description: Detects HTTP requests to the Fabric OS REST API management interface containing
  shell metacharacter patterns consistent with CWE-78 command injection attempts.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87680
author: Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1190
  - attack.execution
  - cve.2026.87680
logsource:
  category: webserver
  product: brocade
detection:
  selection_method:
    cs-method:
      - POST
      - PUT
      - PATCH
      - GET
  selection_uri:
    cs-uri-stem|contains:
      - '/rest/'
      - '/api/'
  selection_payload:
    cs-uri-query|contains:
      - '|'
      - ';'
      - '$(('
      - '`'
      - '>'
      - '&&'
  condition: selection_method and selection_uri and selection_payload
falsepositives:
  - Legitimate administrative scripts that embed special characters in quoted parameters
level: high

YARA Rule

rule CVE_2026_87680_Brocade_FabricOS_REST_CMDInjection
{
    meta:
        description = "Detects command injection payload patterns against the Brocade Fabric OS REST API management interface"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87680"
        cve = "CVE-2026-87680"
        cwe = "CWE-78"
        author = "Threat Intelligence"
        date = "2026-01-01"
        severity = "high"

    strings:
        $s1 = "Fabric OS" ascii nocase
        $s2 = "rest" ascii nocase
        $inj1 = ";" ascii
        $inj2 = "&&" ascii
        $inj3 = "$(" ascii
        $inj4 = "`" ascii
        $inj5 = "|" ascii

    condition:
        uint32(0) == 0x464C457F or // ELF header
        (
            any of ($s*) and
            2 of ($inj*)
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-87680 Brocade Fabric OS REST API Command Injection Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/rest/"; fast_pattern; http.request_body; pcre:"/(;|\||&&|\$\(|`)\s*(cat|id|whoami|uname|sh|bash|wget|curl)/i"; classtype:web-application-attack; reference:cve,2026-87680; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-87680; metadata:affected_product "Brocade Fabric OS", attack_target "SAN_Switch", deployment "Perimeter_and_Management_VLAN", signature_severity "Major", created_at "2026_01_01"; sid:202687680; rev:1;)

Elastic Detection

sequence by process.entity_id with maxspan=30s
  [network where
     event.action == "http_request" and
     url.path : ("/rest/*", "/api/*") and
     http.request.method in ("POST", "PUT", "PATCH")]
  [process where
     event.type == "start" and
     process.parent.name in ("httpd", "lighttpd", "node", "java") and
     process.name in ("sh", "bash", "busybox", "cmd")]

Splunk SPL Query

index=web OR index=proxy sourcetype IN (access_combined, brocade:rest)
| eval uri=coalesce(uri, url, cs_uri_stem), query=coalesce(uri_query, cs_uri_query, query)
| where (match(uri, "(?i)/(rest|api)/"))
| search (query="*;*" OR query="*`*" OR query="*$(*" OR query="*&&*" OR query="*|*" OR query="*>/*")
| stats count min(_time) as first_seen max(_time) as last_seen values(query) as payloads by src_ip, uri
| where count >= 1
| sort - count
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="brocade,fabricos,web,attack,">
  <rule id="2026876" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <if_sid>31100</if_sid>
    <field name="url">/rest/|/api/</field>
    <regex type="pcre2">(?i)(\|\s*(cat|id|whoami|uname|sh|bash|wget|curl)|;\s*(cat|id|whoami|uname|sh|bash)|\$\(|`\s*(cat|id|whoami))</regex>
    <description>CVE-2026-87680: Possible command injection against Brocade Fabric OS REST API management interface</description>
    <mitre>
      <id>T1190</id>
      <id>T1059</id>
    </mitre>
    <group>cve_2026_87680,command_injection,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description references versions "before 10.0.1," implying 10.0.1 as the remediation target, but no vendor advisory, changelog, or fix reference was supplied in the tracked data, so this cannot be treated as a verified patch.

1) Immediate mitigations (interim, until a verified fix can be applied)

• Restrict access to the Fabric OS REST API management interface to a dedicated, tightly controlled management network or out-of-band segment. Block it from user VLANs, the general corporate network, and the internet.
• Enforce least privilege on management accounts: remove default and shared credentials, rotate service-account secrets, and disable API access for accounts that do not require it.
• Enforce multi-factor authentication at the access layer (jump hosts, bastion, VPN) in front of the management interface.
• Enable and centralize audit logging for the REST API management interface; forward logs to the SIEM and alert on the metacharacter patterns in the Detection Guidance section.
• Segment the SAN management plane from data-plane networks so that a compromised switch cannot be used as a pivot into broader infrastructure.
• If the organization cannot isolate the interface, consider temporarily disabling REST API management access where the CLI or a constrained management path is a viable alternative — validate operational impact first.

2) Patch / upgrade steps

• Contact Brocade (Broadcom) support to obtain the authoritative advisory and the confirmed fixed release. Ingested data indicates versions before 10.0.1 are affected; treat 10.0.1 as the presumptive remediation baseline pending vendor confirmation.
• Inventory all Fabric OS switches with the REST API management interface enabled. Record model, firmware version, and exposure. Prioritize internet- or broad-network-reachable devices.
• Schedule an upgrade window per switch (or per fabric segment) with SAN change-control approval. Validate zoning and fabric health post-upgrade. Test in a lab fabric where possible before production rollout.
• After upgrading, verify the REST API management interface no longer returns injected output or spawns shell subprocesses when metacharacters are supplied in parameters (authorized testing only).

3) Long-term hardening

• Adopt a firmware lifecycle program with defined patch SLAs for SAN infrastructure; SAN switches are frequently under-monitored relative to servers and deserve the same vulnerability-management rigor.
• Apply a strict management-plane design: dedicated management VLANs, ACLs, 802.1X or equivalent, and no management reachability from general-purpose networks.
• Implement API authentication hardening: unique per-service credentials, short-lived tokens where supported, and monitoring for anomalous admin API usage (new admin accounts, bulk zoning changes, off-hours configuration writes).
• Add fabric switches to continuous asset inventory and configuration monitoring so unauthorized configuration changes trigger alerts.
• Maintain a tested SAN recovery and restore procedure, including out-of-band console access, so that a compromised or bricked switch can be recovered without relying on the compromised management plane.

References

• NVD — CVE-2026-87680: https://nvd.nist.gov/vuln/detail/CVE-2026-87680
• CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): https://cwe.mitre.org/data/definitions/78.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Brocade / Broadcom Fabric OS product and security documentation portal (consult for the authoritative vendor advisory and fixed release confirmation): https://www.broadcom.com/products/fibre-channel-networking/software/fabric-operating-system
• FIRST EPSS — CVE-2026-87680 score and percentile: https://api.first.org/data/v1/epss?cve=CVE-2026-87680

Note on exploit-in-the-wild evidence: No public PoC, exploit code, or Nuclei template is available for this CVE, and it is not listed in CISA KEV. There are no confirmed reports of active exploitation or named threat-actor campaigns at the time of writing. Potential future exploitation is most likely by actors targeting SAN infrastructure for disruption or ransomware enablement, given the high availability impact of fabric compromise.