CVE-2026-87666

Broadcom Fabric Operating System: OS command injection

Risk score: 65/100
CVSS: 8.0 v3.1
Exploit chance (30 days): 2.6%
Published: 8 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: An OS command injection vulnerability exists in the time and zone management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When updating system timezone settings via the REST API or configuration download routines, the system fails to sanitize input values before processing them in…
Affected: Broadcom Fabric Operating System before 9.2.2
Fix: Upgrade Broadcom Fabric Operating System to 9.2.2 or later.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Broadcom Fabric Operating System: Amber, patch this week. A stack-based buffer overflow vulnerability exists in the SNMP daemon request handling of Brocade Fabric versions before 10.0.1. When processing an incoming SNMPv3 packet, an internal statistics gathering handler copies user-supplied context name data into a fixed-size buffer without properly validating the length of …

The flaws

CVE-2026-87666: OS command injection (CVSS 8.0 · EPSS 3%)
CVE-2026-87684: Stack buffer overflow can lead to remote code execution (CVSS 9.8 · EPSS 1%)
CVE-2026-87680: OS command injection (CVSS 8.8 · EPSS 2%)
CVE-2026-87682: OS command injection (CVSS 8.8 · EPSS 2%)

The fix

Upgrade Broadcom Fabric Operating System: 9.2.2 · 10.0.1 or later on your release line

Who is exposed: Broadcom Fabric Operating System before 10.0.1

Where it stands

No known exploitation

Connects to

Same weakness: OS command injection (CWE-78). 306 other warnings in 30 days
Same product: Earlier Broadcom Fabric Operating System warnings. 39 in the last 90 days

Why it is Amber

CVSS 8.0 high

References

https://support.broadcom.com/external/content/SecurityAdvisories/0/39149

Original description

An OS command injection vulnerability exists in the time and zone management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When updating system timezone settings via the REST API or configuration download routines, the system fails to sanitize input values before processing them in underlying shell execution routines. An authenticated user with low-privilege administrative access can exploit this vulnerability by submitting a crafted timezone string containing shell metacharacters. Successful exploitation allows the attacker to escape the restricted management environment and execute arbitrary shell commands with elevated privileges.

Last activity 8 Oct 2026. Patch Forecast updates every hour.