Brocade Fabric OS EUVD-2026-94694

Exploitation requires an authenticated user with low-privilege administrative access to the switch (PR:L) and adjacent-network reachability to the Fabric OS management plane (AV:A) - not internet-wide access. The specific trigger is updating system timezone settings through the REST API or the configuration download routines using a crafted timezone string containing shell metacharacters; the time and zone management subsystem fails to sanitize this input before passing it to underlying shell execution. Limiting factors: valid management credentials are mandatory, the attacker must be on an adjacent/management network segment, and only Fabric OS versions before 9.2.2d and the 10.0.0 through 10.0.0a1 line are affected. No user interaction is needed (UI:N).

This is a credible, elevated-priority issue but not an emergency. The CVSS 4.0 base score of 8.6 (HIGH) is supported by a vector showing adjacent-network access (AV:A), low attack complexity (AC:L), low privileges required (PR:L), no user interaction (UI:N), and full high impact to confidentiality, integrity, and availability (VC:H/VI:H/VA:H) with no subsequent-system scope change (SC:N/SI:N/SA:N). The adjacent (not fully network/internet) vector plus the requirement for an authenticated low-privilege administrative account meaningfully constrains the attacker population to those already able to reach and log into the switch management plane, so this is a privilege-escalation / management-environment-escape risk rather than a remote unauthenticated takeover. No EPSS score, CISA KEV listing, or public proof-of-concept was provided in the input, so there is no signal of active or probable near-term mass exploitation - the elevated rating is driven by impact severity and low complexity, not by observed exploitation. The description's claim of OS command injection and arbitrary shell command execution with elevated privileges is consistent with CWE-78 and with the VI:H/VC:H/VA:H impacts. No signals are directly conflicting; the main gap is the absence of exploitation-probability data, meaning risk prioritization rests on the vendor advisory and CVSS alone.

An attacker who already holds a low-privilege administrative account on a Brocade Fibre Channel SAN switch (or who has compromised such credentials) connects to the management plane and submits a timezone update via the REST API or a crafted configuration download. By embedding shell metacharacters in the timezone string, they break out of the restricted management shell and run arbitrary OS commands with elevated privileges, taking full control of the switch. No public exploit code was identified at time of analysis, so exploitation currently requires custom tooling.