CVE-2026-82370— Unauthenticated remote command injection in the Brocade SANnav orchestrator HTTP service
Quick assessment
Affected
Brocade SANnav
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Brocade SANnav 编排器的 HTTP 服务存在未授权远程命令注入漏洞，允许网络相邻的攻击者执行任意管理交换机 CLI 命令以及容器管理指令。该漏洞可能使攻击者篡改光纤通道（Fibre Channel）fabric 交换机的配置，或操纵应用容器的运行时环境。此漏洞影响 Brocade SANnav 3.0.1a 之前的所有版本。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-82370
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Unauthenticated remote command injection in the Brocade SANnav orchestrator HTTP service
Source: CVE Program / CVE List V5
Vulnerability Description
Unauthenticated remote command injection in the Brocade SANnav orchestrator HTTP service permits network-adjacent attackers to execute arbitrary administrative switch CLI commands and issue container management instructions. This could allow an attacker to alter Fibre Channel fabric switch configurations or manipulate application container runtimes. This vulnerability affects Brocade SANnav versions before 3.0.1a.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
在命令中使用的特殊元素转义处理不恰当(命令注入)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-82370
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-82370
请登录查看更多情报信息。
Other References for CVE-2026-82370 (1)
Same Patch Batch · Brocade · 2026-09-23 · 3 CVEs total
| CVE-2026-82368 | 8.7 HIGH | Brocade SANnav 3.0.1a前本地非授权访问漏洞 |
| CVE-2026-82369 | 8.6 HIGH | Insufficient input sanitization of shell metacharacters in Brocade SANnav before 3.0.1a |
IV. Related Vulnerabilities
Same product: SANnav
-
CVE-2026-85417
Incomplete property masking in the SANnav logging subsystem -
CVE-2026-14441
Logic flaw in SANnav Java cache key handling object comparis -
CVE-2026-14442
Information exposure vulnerability in the job scheduling com -
CVE-2026-14443
Incomplete log sanitization during bulk IPsec policy collect -
CVE-2026-82372
Improper handling of sensitive data during IPsec policy crea
Same vendor: Brocade
-
CVE-2026-85417
Incomplete property masking in the SANnav logging subsystem -
CVE-2026-14441
Logic flaw in SANnav Java cache key handling object comparis -
CVE-2026-14442
Information exposure vulnerability in the job scheduling com -
CVE-2026-14443
Incomplete log sanitization during bulk IPsec policy collect -
CVE-2026-82372
Improper handling of sensitive data during IPsec policy crea
Same weakness: CWE-77
-
CVE-2026-101008
aaPanel BaoTa File Merge files.py merge_split_file command i -
CVE-2026-65111
NVIDIA NeMo Speech 代码注入致执行漏洞 -
CVE-2026-94139
Chengdu Feiyuxing Technology Feiyu Star Router Cookie send_o -
CVE-2026-94138
Chengdu Feiyuxing Technology Feiyu Star Router send_order.cg -
CVE-2026-94099
Netcore NBR200V2 Backup Restore restore.cgi command injectio
V. Comments for CVE-2026-82370
No comments yet