CVE-2026-94581

Executive Summary

CVE-2026-94581 is an OS command injection vulnerability (CWE-78) in the REST API management interface of Brocade Fabric OS versions before 9.2.2d and versions 10.0.0 through 10.0.0a1. An authenticated attacker holding administrative privileges — specifically the ability to configure SSH known host settings — can inject shell metacharacters into crafted parameter values, resulting in arbitrary command execution with root permissions on the underlying host. Because the affected product is a storage-area-network (SAN) fabric operating system, successful exploitation grants full control over critical Fibre Channel infrastructure, making this a high-impact risk for data-center environments.

Technical Analysis

The vulnerability resides in the REST API management interface of Brocade Fabric OS. The NVD description states that the flaw is triggered when an attacker with administrative privileges configures SSH known host settings and supplies "specially crafted parameter values containing shell metacharacters." This indicates that a user-controlled parameter is passed into an operating-system shell without adequate sanitization or quoting — the classic root cause of CWE-78 OS command injection. Because the injected input reaches a shell interpreter, shell metacharacters (such as command separators and substitution operators) are interpreted by the shell rather than treated as literal data, allowing the attacker to append or chain arbitrary system commands.

The vulnerable attack surface is the REST API management interface — the programmable HTTP-based control plane of Fabric OS used for automation and management. The attack does not require network position beyond reachability of that management interface, but it does require authentication with high privileges (the SSH known host configuration capability), which constrains the threat to compromised or malicious administrative accounts. Critically, the resulting command execution occurs "with root permissions," meaning the injected commands run with the highest privilege level on the host operating system that underpins the switch. This elevates a management-plane weakness into full host-level compromise.

No public proof-of-concept, exploit code, or Nuclei template has been identified, and the description does not disclose specific parameter names, REST endpoints, or function names. As a result, the precise injection point and payload construction cannot be verified from available data. The analysis must therefore remain at the vulnerability-class level: unsanitized administrative input flowing into a shell. No CVSS vector is provided by the source data; the vector listed in METADATA reflects the characteristics described (network-reachable REST API, high privileges required, scope change to the host OS, and high confidentiality/integrity/availability impact) and should be treated as an analyst-derived estimate rather than a vendor-assigned score.

Exploitation Scenarios

No public PoC available; the attack chain below is inferred from the vulnerability class (CWE-78) and the NVD description.

1. Reconnaissance / target identification. An attacker identifies Brocade Fabric OS management interfaces exposed to reachable networks. REST API management endpoints are typically reachable over HTTPS, and hosts can be fingerprinted by product banners, TLS certificates, or the REST API's characteristic responses. The attacker confirms the target runs an affected version (before 9.2.2d, or 10.0.0 through 10.0.0a1).

2. Credential acquisition. Because exploitation requires an authenticated, high-privileged account with permission to configure SSH known host settings, the attacker must first obtain valid administrative credentials. This may occur through credential theft, password reuse, prior compromise of an administrative workstation, or abuse of a legitimate administrative account. This privilege requirement is the primary barrier to exploitation.

3. Triggering the OS command injection. Once authenticated, the attacker invokes the REST API functionality used to configure SSH known host settings. In the parameter value that is ultimately passed to the host shell, the attacker supplies crafted input containing shell metacharacters. Because the value is not safely sanitized or quoted before being interpreted by the shell, the metacharacters allow the attacker to break out of the intended command context and append or substitute their own commands, which the shell then executes.

4. Payload execution and post-exploitation impact. The injected commands execute with root permissions on the host operating system. From there, the attacker can achieve full host compromise: reading or modifying switch configuration and fabric data, altering or disabling security controls, establishing persistence, pivoting to other fabric members or management systems, and disrupting SAN availability. Because Fabric OS underpins storage networking, root-level compromise can translate into broad impact across connected storage and server infrastructure.

Impact Assessment

The impact of CVE-2026-94581 is severe for affected SAN fabrics. Successful exploitation yields arbitrary OS command execution as root, which is effectively complete compromise of the switch host. The confidentiality, integrity, and availability impacts are all high: an attacker can exfiltrate sensitive fabric and configuration data, alter zoning and fabric configuration, disable or weaken security controls, install persistence, and disrupt or destroy storage connectivity — directly affecting dependent servers and applications.

The scope of impact extends beyond the single device. Brocade Fabric OS switches are centrally managed components of storage networks; compromise of one switch can serve as a pivot point into the wider fabric and adjacent management infrastructure. The blast radius therefore includes all hosts and applications dependent on the SAN, plus any management platforms with trust relationships to the switch. The high-privilege authentication requirement (PR:H) somewhat limits opportunistic mass exploitation, but in environments where administrative credentials are reused or poorly protected, the practical risk remains high. The vendor/product field is recorded as "Unknown" in the source data, but the NVD description explicitly attributes the flaw to Brocade Fabric OS, and this report follows that attribution.

Detection Guidance

Sigma Rule

title: Brocade Fabric OS REST API OS Command Injection Attempt (CVE-2026-94581)
id: 3f9c1e2a-7b4d-4a6e-9c1f-brocade94581
status: experimental
description: Detects shell metacharacters in REST API requests to Brocade Fabric OS management interfaces, indicative of OS command injection against SSH known host configuration.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-94581
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1190
  - attack.execution
logsource:
  category: webserver
  product: brocade
detection:
  selection_method:
    cs-method:
      - POST
      - PUT
      - PATCH
  selection_uri:
    cs-uri-stem|contains: 'rest'
  selection_payload:
    cs-uri-query|contains:
      - ';'
      - '|'
      - '&&'
      - '`'
      - '$('
      - '>/'
      - 'known'
      - 'host'
  condition: selection_method and selection_uri and selection_payload
falsepositives:
  - Legitimate administrative scripts with encoded characters
level: high

YARA Rule

rule CVE_2026_94581_Brocade_REST_CMDi
{
    meta:
        description = "Detects shell metacharacter payloads targeting Brocade Fabric OS REST API SSH known host configuration (CVE-2026-94581)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-94581"
        date = "2026-01-01"
        severity = "high"

    strings:
        $api1 = "known" ascii nocase
        $api2 = "host" ascii nocase
        $meta1 = ";" ascii
        $meta2 = "|" ascii
        $meta3 = "&&" ascii
        $meta4 = "$(" ascii
        $meta5 = "`" ascii
        $cmd1 = "/bin/sh" ascii
        $cmd2 = "/bin/bash" ascii
        $cmd3 = "wget " ascii
        $cmd4 = "curl " ascii

    condition:
        filesize < 5MB and
        (2 of ($api*)) and
        (2 of ($meta*)) and
        (1 of ($cmd*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-94581 Brocade Fabric OS REST API OS Command Injection Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"rest"; nocase; http.request_body; content:"known"; nocase; http.request_body; pcre:"/(;|\||&&|\$\(|\`)/"; reference:cve,2026-94581; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-94581; classtype:web-application-attack; sid:9458101; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where http.request.method in ("POST", "PUT", "PATCH")
      and http.request.uri contains "rest"
      and http.request.body contains "known" ]
  [ network where http.request.body regex~ """.*(;|\||&&|\$\(|`).*""" ]

Splunk SPL Query

index=web OR index=proxy
| search (uri_path="*rest*" OR uri="*rest*")
| search (http_method="POST" OR http_method="PUT" OR http_method="PATCH")
| eval payload=coalesce(request_body, uri_query, body)
| where match(payload, "(?i)(known.*host)")
| where match(payload, "(;|\||&&|\$\(|`|>/)")
| table _time, src_ip, dest_ip, http_method, uri_path, payload
| sort - _time

Wazuh OSSEC Rule

<group name="brocade,cve-2026-94581,web,">
  <rule id="945810" level="12">
    <decoded_as>json</decoded_as>
    <field name="http.method">POST|PUT|PATCH</field>
    <field name="http.uri" type="pcre2">(?i)rest</field>
    <field name="http.body" type="pcre2">(?i)(known)</field>
    <field name="http.body" type="pcre2">(;|\||&amp;&amp;|\$\(|`)</field>
    <description>CVE-2026-94581: Possible Brocade Fabric OS REST API OS command injection attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations.

   • Restrict network access to the Brocade Fabric OS REST API management interface to trusted administrative networks and jump hosts only, using firewall rules or management VLAN segmentation.
   • Enforce least privilege: review which accounts hold the SSH known host configuration capability and remove it from accounts that do not require it.
   • Enforce strong authentication (multifactor where supported) and rotate administrative credentials, since exploitation requires a high-privileged authenticated account.
   • Monitor for and alert on shell metacharacters in REST API requests to the management interface (see Detection Guidance).

2. Patch/upgrade steps.

   • No tracked source provides a confirmed vendor patch or fixed version reference for this CVE. The affected ranges are those before 9.2.2d and 10.0.0 through 10.0.0a1; the version designation "9.2.2d" implies an applicable fix line, but this has not been corroborated by the provided data.
   • Action: monitor the Brocade/Broadcom advisory channel for an official fix, and upgrade to the vendor-designated fixed release as soon as it is published. Until then, apply the compensating controls above.

3. Long-term hardening.

   • Treat SAN management interfaces as tier-0 critical infrastructure with dedicated, monitored administrative access paths.
   • Adopt input validation and secure coding practices for any management-plane integration; do not pass user-controlled parameters to host shells.
   • Retain immutable administrative logging and forward Fabric OS and access logs to a central SIEM for correlation and anomaly detection.
   • Maintain an inventory of Fabric OS versions and subscribe to vendor security advisories to shorten exposure windows for future management-plane flaws.

References

• NVD — CVE-2026-94581: https://nvd.nist.gov/vuln/detail/CVE-2026-94581
• CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): https://cwe.mitre.org/data/definitions/78.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Brocade / Broadcom security advisories (vendor advisory channel — no CVE-specific advisory confirmed in provided data): https://www.broadcom.com/support/fibre-channel-networking/security
• EPSS score reference (0.01297, 69.5th percentile): https://www.first.org/epss/

Note: CISA KEV status is NO. No public PoC, exploit code, or threat-actor campaign has been identified for this CVE in the available data.