CVE-2026-82370

Unauthenticated remote command injection in the Brocade SANnav orchestrator HTTP service permits network-adjacent attackers to execute arbitrary administrative switch CLI commands and issue container management instructions. This could allow an attacker to alter Fibre Channel fabric switch configurations or manipulate application container runtimes. This vulnerability affects Brocade SANnav versions before 3.0.1a.

CVSS 4.0

8.6CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS

0.6% chance of exploitation in the next 30 days; higher than 48% of CVEs (scores of 2026-10-25)

CWE

CWE-77

Published

2026-09-24

Modified

2026-10-01

Record from

the NVD, synced 2026-10-19

References

• https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38995

Check your stackJSON