CVE-2026-82370 in SANnav
Summary
by MITRE • 09/24/2026
Unauthenticated remote command injection in the Brocade SANnav orchestrator HTTP service permits network-adjacent attackers to execute arbitrary administrative switch CLI commands and issue container management instructions. This could allow an attacker to alter Fibre Channel fabric switch configurations or manipulate application container runtimes. This vulnerability affects Brocade SANnav versions before 3.0.1a.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/24/2026
The identified vulnerability represents a critical security flaw within the Brocade SANnav orchestrator HTTP service, specifically classified as an unauthenticated remote command injection. This type of weakness allows network-adjacent attackers to inject and execute arbitrary commands on the underlying operating system without requiring valid credentials or prior authentication. The core technical failure lies in the improper neutralization of special elements used in OS commands, often referred to as CWE-78 Improper Neutralization of Special Elements used in an OS Command. In this context, the HTTP service fails to adequately sanitize user-supplied input before passing it to system-level interpreters or shell environments. This lack of validation enables malicious actors to bypass intended access controls and interact directly with the host operating system's command line interface.
The operational impact of this vulnerability is severe due to the elevated privileges associated with the SANnav orchestrator service. Attackers can execute arbitrary administrative switch CLI commands, which grants them the ability to alter Fibre Channel fabric configurations. This manipulation can lead to significant disruptions in storage area network operations, including unauthorized changes to zoning, masking, and other critical fabric parameters that govern data flow between servers and storage arrays. Furthermore, the vulnerability extends beyond traditional SAN management by allowing attackers to issue container management instructions. By manipulating application container runtimes, an attacker could potentially compromise the isolation boundaries of containers running on the host system, leading to lateral movement within the infrastructure or denial of service conditions for critical applications.
From a threat intelligence perspective, this exploitation vector aligns with MITRE ATT&CK techniques related to Command and Scripting Interpreter abuse, specifically T1059, where adversaries use built-in operating system utilities to execute commands. The ability to alter Fibre Channel configurations also relates to potential impacts on availability and integrity as defined in the CIA triad, while the container manipulation aspect touches upon privilege escalation and defense evasion strategies if attackers attempt to hide their presence or escalate privileges within the container environment. Given that Brocade SANnav versions prior to 3.0.1a are affected, organizations relying on these older builds face a high risk of unauthorized control over their storage infrastructure.
To mitigate this vulnerability, immediate action is required to update the Brocade SANnav orchestrator software to version 3.0.1a or later, where the input validation and command execution logic have been corrected. In environments where patching cannot be implemented immediately, network segmentation strategies should be employed to restrict access to the HTTP service ports used by SANnav only from trusted management networks. Additionally, implementing strict firewall rules that limit source IP addresses can reduce the attack surface for network-adjacent threats. Regular security audits and vulnerability scans should also be conducted to ensure no other instances of unpatched software remain in production environments, thereby maintaining a robust defense posture against command injection attacks.