Vulnerability · Published Sep 23, 2026 · Assigned by brocade
CVE-2026-82369Insufficient input sanitization of shell metacharacters in Brocade SANnav before 3.0.1a
High 8.6
In plain English
A high-severity OS command injection in SANnav from Brocade. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).
Official description
Insufficient input sanitization of shell metacharacters in the Brocade SANnav CLI scripting component permits authenticated users to break out of restricted execution contexts on managed switches. An attacker with command execution permissions can leverage this flaw to run unauthorized shell commands across target fabric switches, bypassing command allow-lists and obtaining full administrative switch access. This vulnerability affects all Brocade SANnav versions before 3.0.1a.
Affected products (as reported)
Weakness: CWE-78 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N