High severity · published Sep 23, 2026
CVE-2026-82370
Unauthenticated remote command injection in the Brocade SANnav orchestrator HTTP service
8.6
CVSS
0.6%
EPSS
No
On KEV
Description
Unauthenticated remote command injection in the Brocade SANnav orchestrator HTTP service permits network-adjacent attackers to execute arbitrary administrative switch CLI commands and issue container management instructions. This could allow an attacker to alter Fibre Channel fabric switch configurations or manipulate application container runtimes. This vulnerability affects Brocade SANnav versions before 3.0.1a.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SA
SANnav · Brocade
before 3.0.1a · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-82370
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-82370
support.broadcom.com
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38995
More from SANnav
9.8
CVE-2024-4173
SANnav versions exposes Kafka in the wan interface.
9.8
CVE-2024-29966
hard-coded credentials in the documentation that appear as the appliance root password
8.7
CVE-2026-82368
Insecure access controls on internal service ports in Brocade SANnav versions before 3.0.1a allow local, non-administrative host users to communicate directly with backend…
8.6
CVE-2026-82369
Insufficient input sanitization of shell metacharacters in Brocade SANnav before 3.0.1a
8.6
CVE-2024-29959
Brocade Fabric OS switch encrypted passwords in the Brocade SANnav Standby node's support save