Skip to content
Heist/ feed
High

CVE-2026-87662

Type: advisorySource: Official CVE List1 source record

Brocade Fabric versions before 9.2.2d and 10.0.0 through 10.0.0a1 handling of specific download protocols utilizes unsanitized parameter strings. When processing upgrade requests, parameters are converted into system command strings and executed through a system shell interface. Because control characters and shell metacharacters in fields like the host or file path are not stripped or sanitized, an attacker can execute arbitrary shell commands with the firmware management daemon's elevated privileges.

Announced Source revision 1
Original source ↗

CVE-2026-87662

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-87662

Fabric OS

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "vendor": "Brocade",
    "product": "Fabric OS",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "9.2.2d",
        "versionType": "Brocade FabricOS"
      },
      {
        "status": "affected",
        "version": "10.0.0",
        "versionType": "Brocade FabricOS",
        "lessThanOrEqual": "10.0.0a1"
      }
    ],
    "defaultStatus": "unaffected"
  }
]
Related CVEs
CVE-2026-87662

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#16185 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement