CVE-2026-87677 in Fabric OS
Summary
by MITRE • 10/08/2026
An OS command injection vulnerability exists in the account management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When an administrator initiates an account deletion, the system invokes an internal maintenance routine to clean up cryptographic keys associated with the target account. Malformed account names previously accepted by Fabric OS can cause the execution of embedded shell metacharacters, triggering command injection.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified in Brocade Fabric OS versions prior to 9.2.2d and within the range from 10.0.0 through 10.0.0a1 represents a critical security flaw located within the account management subsystem. This specific component is responsible for handling user identity lifecycle operations, including creation, modification, and deletion of administrative accounts. The core issue stems from insufficient input validation during the execution of internal maintenance routines triggered by account deletion requests. When an administrator initiates the removal of a user account, the system automatically invokes background processes to clean up associated resources, specifically cryptographic keys linked to that identity. This automated cleanup process fails to properly sanitize or validate the account name parameter before passing it to underlying operating system commands.
The technical mechanism of this flaw relies on the injection of shell metacharacters through malformed account names. Historically, Fabric OS accepted a broader set of characters in user identifiers than is strictly safe for command-line interpretation. If an attacker can control or influence the naming convention used during account creation—either through direct manipulation if they possess limited privileges that allow account creation, or potentially through other vectors such as LDAP synchronization errors or API interactions—they can embed shell metacharacters like semicolons, pipes, or ampersands into the username. When the deletion routine processes this malformed name, it constructs a system command string without escaping these special characters. Consequently, the operating system interprets the embedded sequences not as part of the filename but as distinct commands to be executed by the shell.
This OS command injection vulnerability allows for arbitrary code execution with the privileges of the service account running the Fabric OS management processes. In many network infrastructure environments, this often translates to root or equivalent high-level administrative access on the underlying Linux-based operating system hosting the switch firmware. The operational impact is severe, as it enables an attacker to bypass authentication controls entirely if they can exploit a secondary vector to create such accounts, or leverage existing compromised credentials with sufficient privilege to trigger deletion routines against maliciously named targets. Once executed, the injected commands can lead to complete compromise of the storage area network switch, including exfiltration of sensitive configuration data, installation of persistent backdoors, and lateral movement into connected server environments that rely on this fabric for access control.
From a classification perspective, this vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command commonly known as OS Command Injection. It also maps to MITRE ATT&CK technique T1059 Command and Scripting Interpreter, specifically sub-techniques involving shell commands such as sh or bash. The attack vector typically requires local access with specific administrative privileges to trigger the deletion routine against a crafted account name, placing it in the Initial Access or Privilege Escalation phases depending on how the malformed account was initially established within the system.
Mitigation strategies must prioritize immediate patching of all affected Brocade Fabric OS instances to versions 9.2.2d and later, as well as any version beyond 10.0.0a1 where this defect has been resolved by vendors through strict input sanitization and parameterized command execution practices. In environments where patching is not immediately feasible, administrators should implement rigorous network segmentation to restrict management plane access from untrusted networks. Additionally, enforcing strict naming conventions for user accounts via policy can reduce the risk of malicious character injection, although this is a compensating control rather than a fix. Regular auditing of account creation and deletion logs should be established to detect anomalous patterns that may indicate exploitation attempts against this specific subsystem flaw.