CVE-2026-87666

An OS command injection vulnerability exists in the time and zone management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When updating system timezone settings via the REST API or configuration download routines, the system fails to sanitize input values before processing them in underlying shell execution routines. An authenticated user with low-privilege administrative access can exploit this vulnerability by submitting a crafted timezone string containing shell metacharacters. Successful exploitation allows the attacker to escape the restricted management environment and execute arbitrary shell commands with elevated privileges.

• CWE-78

• https://support.broadcom.com/external/content/SecurityAdvisories/0/39149Vendor Advisory

Published

Oct 8, 2026

Last Modified

Oct 14, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-87660An improper file permission and missing authorization vulner…7.1
• CVE-2026-87661Brocade Fabric OS versions before 9.2.2d and 10.0.0 through …5.7
• CVE-2026-87662Brocade Fabric versions before 9.2.2d and 10.0.0 through 10.…6.7
• CVE-2026-87663An authentication bypass and command injection vulnerability…6.7
• CVE-2026-87664A session context forgery vulnerability exists in the web ma…7.8
• CVE-2026-87665A stack-based buffer overflow vulnerability exists in the In…7.5
• CVE-2026-87667An argument injection vulnerability exists in the configurat…4.5
• CVE-2026-87668A stack-based buffer overflow vulnerability exists in the di…6.5
• CVE-2026-87669A missing authorization check in Brocade Fabric OS versions …4.3
• CVE-2026-8767A vulnerability has been found in vercel ai up to 3.0.97. Im…7.5
• CVE-2026-87670An authorization logic vulnerability exists in the Brocade F…4.3
• CVE-2026-87671An out-of-bounds memory read vulnerability exists in the web…7.5