CVE-2026-82370

Unauthenticated remote command injection in the Brocade SANnav orchestrator HTTP service

State: Published
Severity: 8.6 High
Published: Sep 23, 2026
Updated: Oct 1, 2026
Reserved: Aug 28, 2026

Description

Unauthenticated remote command injection in the Brocade SANnav orchestrator HTTP service permits network-adjacent attackers to execute arbitrary administrative switch CLI commands and issue container management instructions. This could allow an attacker to alter Fibre Channel fabric switch configurations or manipulate application container runtimes. This vulnerability affects Brocade SANnav versions before 3.0.1a.

Scores

CVSS	Score	Vector	Source
4.0	8.6 High	CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	brocade

Weaknesses

CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

Affected Products

Product	Versions
SANnavBrocade	before 3.0.1aAffectedfrom 3.0.1aNot affected

References

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38995

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.