{"id":"CVE-2026-94586","state":"PUBLISHED","title":"A command injection vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operations of Brocade Fabric OS versions before 9","description":"A command injection vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operations of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user with permissions to perform configuration downloads using remote server profiles can supply malicious parameter strings to execute arbitrary shell commands on the switch with root privileges","publishedAt":"2026-10-08T04:22:23.513Z","updatedAt":"2026-10-09T03:55:33.147Z","severity":{"score":8.5,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"brocade"},"assigner":"brocade","products":["Brocade Fabric OS"],"affected":[{"vendor":"Brocade","product":"Fabric OS","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"9.2.2d","versionType":"Brocade FabricOS"},{"version":"10.0.0","status":"affected","lessThanOrEqual":"10.0.0a1","versionType":"Brocade FabricOS"}]}],"references":["https://support.broadcom.com/external/content/SecurityAdvisories/0/39135"],"weaknesses":["CWE-78"],"ingestedAt":"2026-10-29T20:13:34.582Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/94xxx/CVE-2026-94586.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-94586","state":"PUBLISHED","datePublished":"2026-10-08T04:22:23.513Z","dateUpdated":"2026-10-09T03:55:33.147Z","assignerShortName":"brocade","assignerOrgId":"87b297d7-335e-4844-9551-11b97995a791","dateReserved":"2026-09-21T20:30:21.087Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"A command injection vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operations of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user with permissions to perform configuration downloads using remote server profiles can supply malicious parameter strings to execute arbitrary shell commands on the switch with root privileges"}],"affected":[{"vendor":"Brocade","product":"Fabric OS","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"9.2.2d","versionType":"Brocade FabricOS"},{"version":"10.0.0","status":"affected","lessThanOrEqual":"10.0.0a1","versionType":"Brocade FabricOS"}]}],"references":[{"url":"https://support.broadcom.com/external/content/SecurityAdvisories/0/39135"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"HIGH","baseScore":8.5,"vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-78","lang":"en","description":"CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","type":"CWE"}]}],"providerMetadata":{"shortName":"brocade","orgId":"87b297d7-335e-4844-9551-11b97995a791","dateUpdated":"2026-10-08T04:22:23.513Z"},"impacts":[{"capecId":"CAPEC-88","descriptions":[{"lang":"en","value":"CAPEC-88 OS Command Injection"}]}],"solutions":[{"lang":"en","value":"Security update is provided in Brocade Fabric OS 9.2.2d and 10.0.1","supportingMedia":[{"type":"text/html","base64":false,"value":"<div>Security update is provided in Brocade Fabric OS 9.2.2d and 10.0.1</div>"}]}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.5"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-10-08T00:00:00+00:00","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3","id":"CVE-2026-94586"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-09T03:55:33.147Z"}}]}}}