CVE-2026-94581
Broadcom Fabric Operating System: OS command injection
- Risk score
- 56/100
- CVSS
- 6.8 v3.1
- Exploit chance (30 days)
- 1.5%
- Published
- 8 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- An OS command injection vulnerability exists in the REST API management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 allows an authenticated, high-privileged remote attacker to execute arbitrary system commands with root permissions. An attacker with administrative privileges to co…
- Affected
- Broadcom Fabric Operating System before 9.2.2
- Fix
- Upgrade Broadcom Fabric Operating System to 9.2.2 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.8 medium
References
Original description
An OS command injection vulnerability exists in the REST API management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 allows an authenticated, high-privileged remote attacker to execute arbitrary system commands with root permissions. An attacker with administrative privileges to configure SSH known host settings can supply specially crafted parameter values containing shell metacharacters to trigger command execution on the host system.
Last activity 8 Oct 2026. Patch Forecast updates every hour.