CVE-2026-87666 Brocade CVE debrief

Who should care

System administrators and security teams responsible for Brocade Fabric OS installations should assess exposure and prioritize remediation. They should verify and upgrade to non-affected versions, restrict access to timezone settings, and monitor for suspicious shell activity.

Why it matters

CVE-2026-87666 is an OS command injection vulnerability in Brocade Fabric OS that allows authenticated users with low-privilege administrative access to execute arbitrary shell commands with elevated privileges. Defenders should prioritize verifying and upgrading to non-affected versions, restricting access to timezone settings, and monitoring for suspicious shell activity.

• Elevation of privileges for attackers
• Potential for arbitrary shell command execution
• Increased risk of lateral movement within the network
• Need for verification of affected versions and remediation

Technical summary

The vulnerability exists in the time and zone management subsystem of Brocade Fabric OS. When updating system timezone settings via the REST API or configuration download routines, the system fails to sanitize input values before processing them in underlying shell execution routines. An authenticated user with low-privilege administrative access can exploit this vulnerability by submitting a crafted timezone string containing shell metacharacters.

Defensive priority

Defenders should prioritize verifying and upgrading to non-affected versions of Brocade Fabric OS, restricting access to timezone settings, and monitoring for suspicious shell activity.

Recommended defensive actions

• Verify and upgrade to non-affected versions of Brocade Fabric OS
• Restrict access to timezone settings to authorized personnel
• Monitor for suspicious shell activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, affected versions, and potential exploitation. However, no additional information on exploitation or impact was found. The vulnerability allows authenticated users with low-privilege administrative access to execute arbitrary shell commands with elevated privileges by submitting crafted timezone strings containing shell metacharacters. Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 are affected.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.