Reference page — cumulative record through Saturday, October 3, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV A L N L N H H H 8.6 .0051 41.5 —
AFFECTED Product Versions Fixed SANnav unspecified 3.0.1a
TIMELINE Aug 28 Reserved by brocade Sep 23 Published (CNA: brocade) Oct 1 PATCH SHIPPED — CVE-2026-82369 (Brocade SANnav). Fixed in SANnav 3.0.1a.
Insufficient input sanitization of shell metacharacters in the Brocade SANnav CLI scripting component permits authenticated users to break out of restricted execution contexts on managed switches. An attacker with command execution permissions can leverage this flaw to run unauthorized shell commands across target fabric switches, bypassing command allow-lists and obtaining full administrative switch access. This vulnerability affects all Brocade SANnav versions before 3.0.1a.
| Date | Event | Detail |
|---|---|---|
| August 28, 2026 | Reserved | Reserved by brocade |
| September 23, 2026 | Published | Published (CNA: brocade) |
| October 1, 2026 | PATCH SHIPPED | PATCH SHIPPED — CVE-2026-82369 (Brocade SANnav). Fixed in SANnav 3.0.1a. |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| Brocade | SANnav | — | — | 3.0.1a |
Authoritative record: CVE-2026-82369 at cve.org
Vendors: brocade
Weaknesses: CWE-78
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-82369 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Saturday, October 3, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
