CVE-2026-82370: Brocade SANnav Orchestrator RCE Vulnerability

CVE-2026-82370 Overview

CVE-2026-82370 is an unauthenticated remote command injection vulnerability in the Brocade SANnav orchestrator HTTP service. Network-adjacent attackers can execute arbitrary administrative switch command-line interface (CLI) commands and issue container management instructions. Successful exploitation lets attackers alter Fibre Channel fabric switch configurations or manipulate application container runtimes. The flaw affects all Brocade SANnav versions before 3.0.1a and is tracked under CWE-77 (Improper Neutralization of Special Elements used in a Command).

Critical Impact
Attackers on an adjacent network can pivot through SANnav to reconfigure Fibre Channel fabrics, disrupt storage area network (SAN) availability, and execute arbitrary container operations on the orchestrator host.

Affected Products

Brocade SANnav versions prior to 3.0.1a
Brocade SANnav orchestrator HTTP service
Fibre Channel fabrics and application containers managed by vulnerable SANnav instances

Discovery Timeline

2026-09-24 - CVE-2026-82370 published to the National Vulnerability Database (NVD)
2026-10-01 - Last updated in NVD database
Vendor advisory - Published as Broadcom Security Advisory #38995

Technical Details for CVE-2026-82370

Vulnerability Analysis

The vulnerability resides in the HTTP service that fronts the Brocade SANnav orchestrator. SANnav is Broadcom's management application for Fibre Channel SAN infrastructure, providing centralized configuration of switches and fabrics. The orchestrator exposes endpoints that pass user-supplied input into downstream command handlers without sufficient neutralization of shell metacharacters or control sequences.

Because the vulnerable code path does not require prior authentication, an attacker who can reach the HTTP service over an adjacent network can submit crafted requests that result in arbitrary switch CLI commands or container management instructions being executed. Impact spans confidentiality, integrity, and availability of the storage fabric and the orchestrator host.

Root Cause

The root cause is improper neutralization of special elements used in a command, consistent with [CWE-77]. Input accepted through the orchestrator's HTTP interface flows into command construction logic that does not escape or validate shell-significant characters. The handler then dispatches the composed command to either switch CLI invocation routines or container runtime management calls.

Attack Vector

Exploitation requires network adjacency to the SANnav management plane, such as access to the management virtual local area network (VLAN) or an interconnected segment. No authentication is required to reach the vulnerable code path. An attacker crafts an HTTP request containing injected command fragments. The orchestrator relays the attacker-controlled commands to Fibre Channel switches as administrative CLI operations or to the local container runtime, enabling fabric reconfiguration, service disruption, or lateral access to co-resident containers.

No verified public proof-of-concept exploit code is available. Refer to the Broadcom Security Advisory #38995 for vendor technical details.

Detection Methods for CVE-2026-82370

Indicators of Compromise

Unexpected HTTP requests to the SANnav orchestrator from hosts outside the normal administrator population
Unexplained switch configuration changes, zoning modifications, or firmware operations initiated through SANnav audit logs
New, stopped, or modified containers on the SANnav host that do not correspond to scheduled operational activity
Outbound connections from the SANnav orchestrator to unknown external endpoints following inbound HTTP traffic

Detection Strategies

Inspect SANnav HTTP access logs for requests containing shell metacharacters such as ;, |, &, backticks, or $() sequences in parameter values
Correlate SANnav orchestrator process telemetry with any child shell processes spawned by the HTTP service worker
Compare switch running-configuration snapshots against a known-good baseline to detect unauthorized fabric or zoning changes
Alert on container runtime application programming interface (API) calls originating from the orchestrator process outside of maintenance windows

Monitoring Recommendations

Forward SANnav application logs, host audit logs, and container runtime events to a centralized security information and event management (SIEM) platform
Enable network flow logging on the management VLAN and alert on new source addresses reaching the SANnav HTTP service
Monitor Fibre Channel switch syslog streams for administrative CLI commands that did not originate from an approved change ticket

How to Mitigate CVE-2026-82370

Immediate Actions Required

Upgrade Brocade SANnav to version 3.0.1a or later as directed by Broadcom Security Advisory #38995
Restrict network reachability to the SANnav orchestrator HTTP service to a hardened administrative jump host or bastion segment
Audit SANnav logs and managed switch configurations for signs of unauthorized changes since deployment of the vulnerable version
Rotate credentials and API tokens used by SANnav to interact with Fibre Channel switches and container runtimes

Patch Information

Broadcom addressed CVE-2026-82370 in Brocade SANnav 3.0.1a. Administrators should apply the fixed release following the upgrade guidance in Broadcom Security Advisory #38995. Validate the installed build after upgrade and re-baseline switch configurations once the fixed version is in production.

Workarounds

Place the SANnav management interface behind strict access control lists (ACLs) that permit only designated administrative subnets
Require administrators to reach SANnav through a jump host enforcing multi-factor authentication (MFA) at the network perimeter
Disable or firewall off any non-essential HTTP endpoints exposed by the orchestrator until the upgrade is applied
Increase logging verbosity on the SANnav HTTP service and the host container runtime to improve post-incident forensics

bash

# Example: restrict access to the SANnav orchestrator HTTP service with iptables
# Replace 10.10.20.0/24 with your administrative management subnet
iptables -A INPUT -p tcp --dport 443 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP