Reference page — cumulative record through Saturday, October 3, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV A L N L N H H H 8.6 .0060 47.1 —
AFFECTED Product Versions Fixed SANnav unspecified 3.0.1a
TIMELINE Aug 28 Reserved by brocade Sep 23 Published (CNA: brocade) Oct 1 PATCH SHIPPED — CVE-2026-82370 (Brocade SANnav). Fixed in SANnav 3.0.1a.
Unauthenticated remote command injection in the Brocade SANnav orchestrator HTTP service permits network-adjacent attackers to execute arbitrary administrative switch CLI commands and issue container management instructions. This could allow an attacker to alter Fibre Channel fabric switch configurations or manipulate application container runtimes. This vulnerability affects Brocade SANnav versions before 3.0.1a.
| Date | Event | Detail |
|---|---|---|
| August 28, 2026 | Reserved | Reserved by brocade |
| September 23, 2026 | Published | Published (CNA: brocade) |
| October 1, 2026 | PATCH SHIPPED | PATCH SHIPPED — CVE-2026-82370 (Brocade SANnav). Fixed in SANnav 3.0.1a. |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| Brocade | SANnav | — | — | 3.0.1a |
Authoritative record: CVE-2026-82370 at cve.org
Vendors: brocade
Weaknesses: CWE-77
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-82370 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Saturday, October 3, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
