Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.6

Brocade Fabric OS allows timezone change to run commands

CVE-2026-87666 · published 28 days ago
Summary

Versions of Brocade Fabric OS before 9.2.2d and the early 10.0.0 releases let a low‑privilege administrator change the timezone via the web API or config download without checking the input. By entering specially crafted characters, the user can cause the system to run any command they want with high privileges. Apply the vendor's update or restrict who can change timezone settings to stop this risk.

What to do
  • Update brocade fabric os to version 9.2.2d or later.
Affected software
VendorProductAffected versions
brocade fabric os < 9.2.2d
broadcom fabric_operating_system < 9.2.2d
>= 10.0.0, < 10.0.1
cpe:2.3:o:broadcom:fabric_operating_system:*:*:*:*:*:*:*:*
Original advisory text
An OS command injection vulnerability exists in the time and zone management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When updating system timezone setting...
An OS command injection vulnerability exists in the time and zone management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When updating system timezone settings via the REST API or configuration download routines, the system fails to sanitize input values before processing them in underlying shell execution routines. An authenticated user with low-privilege administrative access can exploit this vulnerability by submitting a crafted timezone string containing shell metacharacters. Successful exploitation allows the attacker to escape the restricted management environment and execute arbitrary shell commands with elevated privileges.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.6 High
Exploitation
3% chance of attack within 30 days
Type
CWE-78OS Command Injection
Timeline
Published8 Oct 2026
Updated30 Oct 2026
First seen8 Oct 2026
Sources
CVE-2026-87666 · NVD
CVE-2026-87666 · MITRE
Track software like this
Free during beta