CVE-2026-94581 in Fabric OS
Summary
by MITRE • 10/08/2026
An OS command injection vulnerability exists in the REST API management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 allows an authenticated, high-privileged remote attacker to execute arbitrary system commands with root permissions. An attacker with administrative privileges to configure SSH known host settings can supply specially crafted parameter values containing shell metacharacters to trigger command execution on the host system.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified in Brocade Fabric OS versions prior to 9.2.2d and within the range of 10.0.0 through 10.0.0a1 represents a critical security flaw located within the REST API management interface. This specific weakness is classified as an operating system command injection, which corresponds directly to CWE-78 in the Common Weakness Enumeration standard. The core technical issue arises from insufficient input validation and sanitization mechanisms when processing parameters related to SSH known host configuration settings. When a user interacts with this part of the API, the application constructs shell commands dynamically using unsanitized user-supplied data without adequately escaping special characters that hold meaning for the underlying operating system shell.
An attacker possessing administrative privileges can exploit this flaw by crafting specific HTTP requests containing malicious payloads within the parameter values intended for SSH known host configuration. By injecting shell metacharacters such as semicolons, pipes, or backticks into these fields, the attacker forces the application to execute unintended commands alongside the legitimate system operations. Because the REST API management interface typically operates with elevated privileges to facilitate network administration tasks, the injected commands are executed with root-level permissions on the host system. This capability allows for complete compromise of the affected storage area network switch or director, enabling the attacker to read sensitive configuration files, modify security policies, install persistent backdoors, or pivot further into the connected enterprise infrastructure.
The operational impact of this vulnerability is severe due to the high privilege level required by the application context and the resulting root access gained upon exploitation. Although the attack requires an authenticated user with administrative rights, this threat model remains significant because insider threats or compromised administrator credentials are common vectors for initial access in industrial control systems and enterprise storage networks. Once exploited, the attacker gains full control over the device's operating system, which can lead to data exfiltration, disruption of critical business operations dependent on SAN availability, and potential lateral movement across the network segment connected to the affected fabric element.
Mitigation strategies must focus primarily on immediate software remediation through vendor-provided updates. Organizations running Brocade Fabric OS versions before 9.2.2d or between 10.0.0 and 10.0.0a1 should upgrade to a patched version that addresses the input validation flaws in the REST API handler for SSH known host settings. In environments where immediate patching is not feasible, network segmentation controls can help limit exposure by restricting access to the management interfaces of affected devices to only trusted administrative subnets. Additionally, implementing strict monitoring and logging on these endpoints can aid in detecting anomalous command execution patterns or unusual outbound connections that may indicate exploitation attempts aligned with ATT&CK techniques related to system command injection and privilege escalation.