OS Command Injection in Brocade Fabric OS Affecting SSH Session Management

CVE-2026-94579

What is CVE-2026-94579?

An OS command injection vulnerability is present in the PAM session cleanup routines during the termination of SSH sessions on affected Brocade Fabric OS versions. This flaw allows an authenticated user, when their username or profile identifier includes shell metacharacters, to execute arbitrary commands with root privileges as their SSH session terminates. This vulnerability can be triggered through authenticated access via an external directory or AAA service, potentially compromising system integrity.

References