{"id":"CVE-2026-87675","published":"2026-10-08T04:17:55.843","lastModified":"2026-10-09T04:18:14.080","description":"An OS command injection vulnerability exists in the configuration management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When performing a configuration download operation, the management daemon will relay configuration parameters, user-supplied relay host strings, and filenames directly to an internal utility script without sufficient character set validation. Because the local utility fails to sanitize shell metacharacters before processing them in a system shell command, a malicious or compromised configuration file can cause arbitrary operating system commands to be executed on a remote local switch when an administrator initiates a configuration download.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://support.broadcom.com/external/content/SecurityAdvisories/0/39146","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}