EUVD-2026-85659
GHSA-gv2c-6mj6-2mr9
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent management-network access (AV:A) and an authenticated scripting account (PR:L); breakout from SANnav to full switch control is a scope change (S:C) with high C/I/A on the fabric.
Primary rating from Vendor (brocade).
CVSS VectorVendor: brocade
Lifecycle Timeline
2DescriptionCVE.org
Insufficient input sanitization of shell metacharacters in the Brocade SANnav CLI scripting component permits authenticated users to break out of restricted execution contexts on managed switches. An attacker with command execution permissions can leverage this flaw to run unauthorized shell commands across target fabric switches, bypassing command allow-lists and obtaining full administrative switch access. This vulnerability affects all Brocade SANnav versions before 3.0.1a.
AnalysisAI
Command injection in the Brocade SANnav CLI scripting component lets an authenticated user who already holds command-execution/scripting permissions break out of the restricted allow-list execution context and run unauthorized shell commands across managed fabric switches, escalating to full administrative switch access. Exploitation requires a valid SANnav account with scripting rights and adjacency to the SAN management plane (AV:A, PR:L) - the product is not internet-reachable by default - and no user interaction is needed once that foothold exists. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated SANnav user (PR:L) who holds command-execution/CLI-scripting permissions within the SANnav management platform, plus adjacent-network access to the SANnav/SAN management plane (AV:A) - not internet-reachable by default. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine mid-to-high priority for organizations running Brocade SANnav, though not an emergency-tier internet-facing bug. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Brocade SANnav to 3.0.1a or later, the vendor-released fix version that corrects the metacharacter sanitization in the CLI scripting component; confirm the exact patched build against the Broadcom advisory at https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38994 before rollout. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Brocade SANnav deployments and confirm which run releases earlier than 3.0.1a, then restrict SANnav scripting and CLI permissions to the smallest possible set of named administrators and audit existing accounts holding command-execution rights for signs of unexpected use; because no vendor-released patch has been identified at time of analysis, do not wait on a fix to begin containment. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Incomplete log sanitization in Brocade SANnav before 3.0.1a causes extension switch IPsec pre-shared keys (PSKs) to be w
In Brocade SANnav before Brocade SANnav 2.2.0, multiple endpoints associated with Zone management are susceptible to SQL
A vulnerability in the role-based access control (RBAC) functionality of the Brocade SANNav before 2.2.0 could allow an
Brocade SANnav deployments running versions before 3.0.1a expose backend management service ports without adequate acces
Pre-shared keys used for IPsec tunnel configuration are recorded in cleartext inside application log files by Brocade SA
Plaintext disclosure of administrative switch credentials and live session tokens in Brocade SANnav discovery-service lo
A vulnerability in the migration script for Brocade SANnav before 3.0 could allow the collection of database sql queries
In Brocade SANnav before Brocade SANnav v2.2.0.2 and Brocade SANnav2.1.1.8, encoded scp-server passwords are stored usin
In Brocade SANnav version before SANN2.2.0.2 and Brocade SANNav before 2.1.1.8, the implementation of TLS/SSL Server Sup
In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehas
Cleartext credential exposure in the job scheduling component of Brocade SANnav causes external server passwords and arc
A vulnerability in update-reports-purge-settings.sh script logging for Brocade SANnav before 2.4.0a could allow the coll
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today