---
id: CVE-2026-87677
title: >-
  An OS command injection vulnerability exists in the account management
  subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through
  10.0.0a1
summary: >-
  An OS command injection vulnerability exists in the account management
  subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through
  10.0.0a1. When an administrator initiates an account deletion, the system
  invokes an internal…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'
cwe:
  - CWE-78
vendor: Brocade
product: Fabric OS
affected:
  - fabric_os < 9.2.2d
  - fabric_os >= 10.0.0 <= 10.0.0a1
published: '2026-10-08'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T05:17:05.833'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-87677'
references:
  - url: 'https://support.broadcom.com/external/content/SecurityAdvisories/0/39131'
    label: sirt@brocade.com
tags:
  - nvd
  - cve.org
cvssSource: cna
ingestedAt: '2026-10-08T05:05:36.680Z'
---

## Overview

An OS command injection vulnerability exists in the account management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When an administrator initiates an account deletion, the system invokes an internal maintenance routine to clean up cryptographic keys associated with the target account. Malformed account names previously accepted by Fabric OS can cause the execution of embedded shell metacharacters, triggering command injection.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.