EUVD-2026-94733
GHSA-rcgg-cjm3-3p46
Severity by source
CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H and PR:L because exploitation requires authenticated access plus a crafted external-directory username with metacharacters; AV:N as SSH is network-reachable; C/I/A:H from root command execution.
Primary rating from Vendor (brocade).
CVSS VectorVendor: brocade
Lifecycle Timeline
2DescriptionCVE.org
An OS command injection vulnerability exists in the PAM (Pluggable Authentication Module) session cleanup routines during SSH session termination on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user authenticating via an external directory or AAA service whose username or profile identifier contains shell metacharacters can trigger arbitrary command execution with root privileges when their remote SSH session closes.
AnalysisAI
OS command injection in the PAM session-cleanup path of Brocade Fabric OS (before 9.2.2d, and 10.0.0 through 10.0.0a1) lets an authenticated user whose directory- or AAA-supplied username or profile identifier contains shell metacharacters execute arbitrary commands as root when their remote SSH session terminates. Three prerequisites must hold simultaneously: the switch must authenticate users against an external directory or AAA service (LDAP/RADIUS/TACACS+) rather than local accounts only, the attacker must be able to set or influence the username/profile identifier in that directory, and the attacker must be able to establish and then close an authenticated SSH session - so switches using only local authentication are not exposed. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three concrete prerequisites must all hold: (1) the Fabric OS switch is configured to authenticate users against an external directory or AAA service (LDAP/RADIUS/TACACS+) rather than only local accounts; (2) the attacker can set or influence a username or profile identifier in that directory that contains shell metacharacters; and (3) the attacker can establish and then close an authenticated SSH session. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Impact is severe - successful exploitation yields arbitrary command execution as root (CVSS 4.0 VC:H/VI:H/VA:H) via CWE-78 OS command injection in Fabric OS PAM session-cleanup logic. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to upgrade Fabric OS to 9.2.2d or later for the 9.x branch and to the fixed 10.0.x release identified in the Broadcom/Brocade advisory (https://support.broadcom.com/external/content/SecurityAdvisories/0/39147) for deployments running 10.0.0 through 10.0.0a1, since the advisory text names 9.2.2d as the 9.x fix boundary but does not state an explicit 10.0.x fix version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Authenticated OS command injection in the management interface and session-processing routines of Brocade Fabric OS allo
Brocade Fabric OS contains an OS command injection flaw in the REST API management interface that lets an authenticated,
OS command injection in the WebTools administrative interface of Brocade Fabric OS lets an authenticated, high-privilege
Stack-based buffer overflow in the SNMP daemon of Brocade Fabric OS (all versions before 10.0.1) lets a remote, unauthen
Command injection in the REST API management interface of Brocade Fabric OS allows an authenticated low-privileged user
Authenticated attackers with access to the adjacent management network can exploit stack-based buffer overflows in the R
An authenticated, low-privileged user in one Virtual Fabric on a Brocade Fabric OS switch can submit a request carrying
Heap corruption in Brocade Fabric OS before 10.0.1 allows an authenticated administrator to crash a SAN switch's managem
Authentication bypass in Brocade Fabric OS 9.2.2d and 10.0.0 through 10.0.0a1 allows a local low-privileged process to f
Local privilege escalation in Brocade Fabric OS (versions before 9.2.2d and 10.0.0 through 10.0.0a1) allows an unprivile
Command injection in the security certificate management component of the Brocade Fabric OS administrative management AP
An arbitrary file-move flaw in the WebTools management interface of Brocade Fabric OS (all builds before 9.2.2d and 10.0
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today