CVE-2026-82369

Insufficient input sanitization of shell metacharacters in Brocade SANnav before 3.0.1a

State: Published
Severity: 8.6 High
Published: Sep 23, 2026
Updated: Oct 1, 2026
Reserved: Aug 28, 2026

Description

Insufficient input sanitization of shell metacharacters in the Brocade SANnav CLI scripting component permits authenticated users to break out of restricted execution contexts on managed switches. An attacker with command execution permissions can leverage this flaw to run unauthorized shell commands across target fabric switches, bypassing command allow-lists and obtaining full administrative switch access. This vulnerability affects all Brocade SANnav versions before 3.0.1a.

Scores

CVSS	Score	Vector	Source
4.0	8.6 High	CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	brocade

Weaknesses

CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')

Affected Products

Product	Versions
SANnavBrocade	before 3.0.1aAffectedfrom 3.0.1aNot affected

References

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38994

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.