Brocade

By the Year

In 2026 there have been 84 vulnerabilities in Brocade with an average score of 7.3 out of ten. Last year, in 2025 Brocade had 3 security vulnerabilities published. That is, 81 more vulnerabilities have already been reported in 2026 as compared to last year.

Recent Brocade Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-87428	Oct 08, 2026	Brocade ASCG <=3.5.0 Local Auth Exploits SANnav Credentials In Brocade ASCG before 3.5.0, a  local unauthorized user on the ASCG VM who can issue a request to the SANnav host network namespace can extract stored management credentials for onboarded SANnav instances and compromise connected Brocade SANnav servers or managed Brocade Fibre Channel switches.
CVE-2026-87426	Oct 08, 2026	Brocade ASCG <=3.5.0: Unauth Net ENUM of Fabric OS via Mgmt Endpoints An unauthenticated network-based attacker can query specific internal management endpoints on Brocade ASCG versions before 3.5.0 to enumerate the configuration details and state of managed Brocade Fabric OS (FOS) switches. This results in the unauthorized disclosure of the customer's SAN fabric management topology and switch connectivity attributes.
CVE-2026-87425	Oct 08, 2026	Brocade ASCG <3.5.0 TLS Trust Store Modification (MITM) An unauthenticated remote attacker can modify the TLS client trust store in Brocade ASCG versions before 3.5.0. By supplying an unauthorized Certificate Authority (CA) certificate to an unauthenticated management interface, the attacker can cause the system to trust unauthorized certificates, potentially enabling Man-in-the-Middle (MITM) attacks against outbound communications with managed switches and peer nodes.
CVE-2026-87424	Oct 08, 2026	Auth Bypass in Brocade ASCG <3.5.0 SupportLink API A vulnerability in the SupportLink API authentication component of Brocade ASCG versions prior to 3.5.0 allows an attacker to bypass authentication across deployments due to the use of a hard coded cryptographic key.
CVE-2026-85490	Oct 08, 2026	Brocade ASCG<5.0: Path Traversal in support bundle extraction leads to RCE When Brocade ASCG before 3.5.0 processes support bundle archives ingested from remote compromised endpoints, the application fails to sanitize path traversal sequences contained within archive entries prior to extraction. An unauthenticated remote attacker capable of sending or intercepting ingested archive files can leverage this flaw to write arbitrary files to restricted locations on the underlying host, potentially leading to remote code execution.
CVE-2026-85489	Oct 08, 2026	Unauthenticated API Access in Brocade ASCG <3.5.0 (Admin Service) An authentication flaw exists in the Brocade ASCG administrative management service component. An unauthenticated network user can issue direct API requests to perform privileged actions, including accessing sensitive system configuration mapping data, modifying managed device inventories, and altering operational settings. This vulnerability affects all versions of Brocade ASCG before 3.5.0.
CVE-2026-85488	Oct 08, 2026	Brocade ASCG (<3.5.0) default cred in script enables local privilege escalation Brocade ASCG before 3.5.0 has a well-known Brocade default password embedded in a script distributed to every customer. Any local authenticated user with read access to the installation path can discover this credential and perform privilege escalation on affected Open Virtual Appliance (OVA) deployments, where default configuration settings remain in place.
CVE-2026-85487	Oct 08, 2026	Brocade ASCG <3.5.0 HTTP Service Path Traversal A path traversal vulnerability exists in the HTTP service component of Brocade ASCG versions before 3.5.0. An unauthenticated attacker on the local network could send a manipulated API request to the service endpoint bypassing path restrictions to arbitrary file read, file write, or file deletion operations.
CVE-2026-85486	Oct 08, 2026	Brocade ASCG <3.5.0 RCE via Unvalidated Form Input Brocade ASCG before 3.5.0 improperly processes user input by evaluating form data prior to validation. When an authenticated user submits a configuration form, the submitted text could immediately be processed. A malicious actor with basic access can supply crafted input to execute arbitrary code on the server and take control of the application.
CVE-2026-85423	Oct 08, 2026	Brocade ASCG <=3.4.9: Unauth Data Collector Auth Bypass Enables SSH Proxy A vulnerability has been identified in the data collection service of Brocade ASCG versions before 3.5.0. An API endpoint within the data collector service fails to perform authentication or authorization checks on incoming requests. An attacker with network access to the service can instruct the application to establish SSH connections to arbitrary hosts and execute arbitrary system commands, effectively turning the appliance into an unauthenticated proxy or execution vector.
CVE-2026-85422	Oct 08, 2026	Static Key Exfiltration in Brocade ASCG <3.5.0 (CVE-2026-85422) A vulnerability in Brocade ASCG version before 3.5.0 could allow an attacker to obtain a static cryptographic key hardcoded into the software binaries to secure sensitive data at rest and to protect inter-node communication protocols. An attacker who extracts this key can decrypt stored management credentials or craft forged administrative synchronization messages.
CVE-2026-85421	Oct 08, 2026	Brocade ASCG Unauth Bypass HTTPS Auth Before v3.5.0 A critical security vulnerability has been identified in Brocade ASCG versions before 3.5.0. The HTTPS service fails to properly enforce authentication or access control checks on incoming requests. An unauthenticated attacker with network access can issue control commands, alter cluster states, and modify system configurations, leading to a complete compromise of the streaming service control plane.
CVE-2026-5769	Oct 08, 2026	Brocade SANnav <3.0.1 OOM swap file plaintext password leak A vulnerability in Brocade SANnav before 3.0.1 can have the Brocade Fabric OS switch admin password captured in plaintext within a memory swap file on the server hosting the Brocade SANnav Virtual Machine (VM). This can happen when the SANnav server encounters an Out Of Memory (OOM) condition. The vulnerability could allow an authenticated admin user with access to the server hosting the SANnav to potentially view the memory swap file and access the password(s).
CVE-2026-5049	Oct 08, 2026	Path Traversal in Brocade SANnav <3.0.0a Zone Alias Import A path traversal vulnerability affects the The Zone Alias Import flow feature in Brocade SANnav before 3.0.0a. A local authenticated attacker can write an uploaded content outside the intended directory.
CVE-2026-5048	Oct 08, 2026	Brocade SANnav <3.0.0a SQL Injection in REST API In Brocade SANnav before 3.0.0a, an SQL Injection vulnerability in various external API inventories have a vulnerability that allows an authenticated attacker to inject malicious data into some of the REST API -query parameters.
CVE-2026-5047	Oct 08, 2026	Brocade SANnav <2.4.0b,3.0.0: Log Exposure of Encoded Passwords A vulnerability in Brocade SANnav before 2.4.0b and 3.0.0 prints encoded passwords and  authentication tokens in log files. The vulnerability could allow an authenticated attacker with access to the log file including the SANnav supportsave to access the passwords.
CVE-2023-5649	Oct 08, 2026	Brocade ASCG IMPU DoS via case creds (pre 3.0) An Improper Input Validation vulnerability for the registered case credentials in Brocade ASCG before v3.0 could allow a local authenticated user to provide invalid inputs like special characters leading to a Denial of Service (DoS) when collecting supportsave from a Brocade Switch.
CVE-2023-5648	Oct 08, 2026	Brocade ASCG <3.0 Missing HTTP Headers Allow XSS & Clickjacking In Brocade ASCG before Brocade ASCG v3.0, several security-related HTTP Headers were missing in various Brocade ASCG URL paths, aiding unauthenticated attackers to perform attacks such as Cross-Site Scripting, Clickjacking, Information disclosure, and more.
CVE-2026-94585	Oct 08, 2026	Brocade Fabric OS <9.2.2d Authentication Bypass via SSO Endpoint An authentication bypass vulnerability exists in the web management interface of Brocade Fabric OS versions before 9.2.2d running on the MXG610 platform. An unauthenticated, network-adjacent attacker can exploit an unauthenticated endpoint within the Single Sign-On (SSO) workflow to gain administrative access to the device management interface.	Fabric Os
CVE-2026-94587	Oct 08, 2026	Brocade Fabric OS <=9.2.2d/10.0.0: WebTools weblinker Buffer Overflow A buffer overflow vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operations of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user with permissions to perform configuration downloads using remote server profiles can overflow stack buffers causing a crash of the weblinker daemon.	Fabric Os
CVE-2026-94579	Oct 08, 2026	Brocade FabricOS <=9.2.2d/10.0.0a1 PAM Session Cleanup SSH CMD Injection An OS command injection vulnerability exists in the PAM (Pluggable Authentication Module) session cleanup routines during SSH session termination on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user authenticating via an external directory or AAA service whose username or profile identifier contains shell metacharacters can trigger arbitrary command execution with root privileges when their remote SSH session closes.	Fabric Os
CVE-2026-94576	Oct 08, 2026	Brocade Fabric OS <9.2.2d / 10.0.0a1 Priv Esc via Auth Logic Bypass An authentication logic and privilege escalation vulnerability exists in the account management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. Under specific conditions, an authenticated user can bypass authorization restrictions intended to prevent modifying another account's access privileges. Exploitation allows a lower-privileged user to assign administrative roles to a target account, leading to localized privilege escalation.	Fabric Os
CVE-2026-87661	Oct 08, 2026	Brocade Fabric OS DoS via Apache Config Parsing before v9.2.2d & 10.0.0a1 Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 directly accepts Apache configuration file data during service setup or re-initialization. An attacker capable of corrupting the configuration structure will prevent the web management service from starting or recovering during service bring-up, leading to a persistent Denial of Service (DoS) of the administrative web interface.	Fabric Os
CVE-2026-87677	Oct 08, 2026	Brocade Fabric OS 9.2.2d/10.0.0a1 Command Injection via Account Delete An OS command injection vulnerability exists in the account management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When an administrator initiates an account deletion, the system invokes an internal maintenance routine to clean up cryptographic keys associated with the target account. Malformed account names previously accepted by Fabric OS can cause the execution of embedded shell metacharacters, triggering command injection.	Fabric Os
CVE-2026-94586	Oct 08, 2026	Command Injection via Config Download in Brocade Fabric OS <9.2.2d/10.0.0a1 A command injection vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operations of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user with permissions to perform configuration downloads using remote server profiles can supply malicious parameter strings to execute arbitrary shell commands on the switch with root privileges	Fabric Os
CVE-2026-94581	Oct 08, 2026	OS Command Injection in Brocade Fabric OS <9.2.2d/10.0.0a1 via REST API An OS command injection vulnerability exists in the REST API management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 allows an authenticated, high-privileged remote attacker to execute arbitrary system commands with root permissions. An attacker with administrative privileges to configure SSH known host settings can supply specially crafted parameter values containing shell metacharacters to trigger command execution on the host system.	Fabric Os
CVE-2026-94577	Oct 08, 2026	Brocade Fabric OS <9.2.2d <10.0.0a1 Priv Esc via CLI Auth Bypass A privilege escalation vulnerability exists in the internal Command-Line Interface (CLI) authorization handling mechanism of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user or local process that can manipulate the process execution environment can bypass Role-Based Access Control (RBAC) validation checks. Successful exploitation allows an attacker to elevate privileges to root	Fabric Os
CVE-2026-87664	Oct 08, 2026	Brocade Fabric OS 9.2.2d-10.0.0a1 Session Context Forgery A session context forgery vulnerability exists in the web management daemon of Brocade Fabric OS versions 9.2.2d and 10.0.0 through 10.0.0a1. When processing local inter-process communication (IPC) storage callbacks, the service accepts and registers session structures including administrative role permissions, user identifiers, and authorization flagswithout verifying the identity or authenticity of the sending process. An attacker can obtain elevated administrative privileges on the web management interface without legitimate authentication.	Fabric Os
CVE-2026-87663	Oct 08, 2026	Brocade Fabric OS <9.2.2d/10.0.0a1 Auth Bypass & Cmd Injection An authentication bypass and command injection vulnerability exists in the inter-switch remote execution service of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When processing remote command execution IPC frames across the fabric, the receiving switch processes these commands at an elevated processing level without proper verification of transmitted parameters. This allows an attacker on a single fabric-connected switch to escalate privileges and execute arbitrary root commands locally or across other managed fabric members where remote execution functionality is enabled.	Fabric Os
CVE-2026-87662	Oct 08, 2026	Brocade Fabric cmdinjection via unsanitized params <9.2.2d,10.0.0a1 Brocade Fabric versions before 9.2.2d and 10.0.0 through 10.0.0a1 handling of specific download protocols utilizes unsanitized parameter strings. When processing upgrade requests, parameters are converted into system command strings and executed through a system shell interface. Because control characters and shell metacharacters in fields like the host or file path are not stripped or sanitized, an attacker can execute arbitrary shell commands with the firmware management daemon's elevated privileges.	Fabric Os
CVE-2026-87660	Oct 08, 2026	Brocade Fabric OS <=9.2.2d/10.0.0a1 KMod File Perm Bypass An improper file permission and missing authorization vulnerability exists in the diagnostic kernel module subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An unprivileged local user can invoke privileged hardware tests, force system error conditions, reset hardware blades, or disrupt storage fabric operations.	Fabric Os
CVE-2026-87667	Oct 08, 2026	Brocade Fabric OS pre-9.2.2d/10.0.0a1 Arg-Inject CVE-2026-87667 An argument injection vulnerability exists in the configuration management command-line utility of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When executing configuration viewing commands with search pattern filters, the utility fails to sanitize user-supplied search string options before passing them to internal search commands. An authenticated user with low-privilege administrative access can exploit this vulnerability to read arbitrary files on the local operating system, including sensitive configuration files, system password hashes and system secrets.	Fabric Os
CVE-2026-87666	Oct 08, 2026	OS Command Injection in Brocade Fabric OS <9.2.2d/10.0.0a1 Time-Zone REST API An OS command injection vulnerability exists in the time and zone management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When updating system timezone settings via the REST API or configuration download routines, the system fails to sanitize input values before processing them in underlying shell execution routines. An authenticated user with low-privilege administrative access can exploit this vulnerability by submitting a crafted timezone string containing shell metacharacters. Successful exploitation allows the attacker to escape the restricted management environment and execute arbitrary shell commands with elevated privileges.	Fabric Os
CVE-2026-87675	Oct 08, 2026	Brocade Fabric OS <9.2.2d/10.0.0a1 OS Command Injection via Config Download An OS command injection vulnerability exists in the configuration management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When performing a configuration download operation, the management daemon will relay configuration parameters, user-supplied relay host strings, and filenames directly to an internal utility script without sufficient character set validation. Because the local utility fails to sanitize shell metacharacters before processing them in a system shell command, a malicious or compromised configuration file can cause arbitrary operating system commands to be executed on a remote local switch when an administrator initiates a configuration download.	Fabric Os
CVE-2026-87674	Oct 08, 2026	Local Priv Escalation via IPC in Brocade Fabric OS <10.0.0a1 A local privilege escalation vulnerability exists in the system logging daemon of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. Insufficient access controls on internal inter-process communication (IPC) channels allow an unprivileged local user to submit malformed logging configurations. Due to improper input sanitization during configuration file generation, an attacker can inject arbitrary directives that execute with elevated privileges when the logging service reloads, leading to local privilege escalation.	Fabric Os
CVE-2026-87673	Oct 08, 2026	OS Cmd Injection in Brocade Fabric OS <9.2.2d & 10.0.0-10.0.0a1 CLI An OS command injection vulnerability exists in maintenance command-line diagnostic utilities on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. The binary fails to sanitize user-supplied input options when invoking underlying system commands through a shell interpreter. A privileged user with maintenance account access can exploit this issue by supplying crafted parameters, which results in arbitrary OS command execution with root privileges.	Fabric Os
CVE-2026-87687	Oct 08, 2026	Brocade Fabric OS pre-9.2.2d/10.0.0 vulnerability: unauthorized crossfabric ops An authorization and input validation vulnerability exists in Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user with restricted privileges in one Virtual Fabric can exploit this issue by submitting a specially crafted request containing an arbitrary fabric identifier. This allows the user to perform unauthorized cross-fabric operations and view configuration details within tenants/Virtual Fabrics to which they have not been granted access.	Fabric Os
CVE-2026-87685	Oct 08, 2026	Brocade Fabric OS <9.2.2d & <10.0.0a1 Arbitrary File Manipulation via WebTools An arbitrary file manipulation vulnerability exists in the WebTools management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When processing configuration transfer requests, the application fails to properly validate and sanitize a user-supplied status file path parameter. An authenticated administrative user can exploit this issue by submitting a specially crafted status file parameter, causing the underlying process to move an arbitrary system file to a predictable, world-readable temporary directory. This can lead to persistent Denial of Service (DoS), critical system file destruction, host compromise, or sensitive data leakage.	Fabric Os
CVE-2026-87688	Oct 08, 2026	Brocade Fabric OS <9.2.2d/10.0.0a1 Cert Mgmt Input Validation RCE An input validation vulnerability exists in the security certificate management component of the Brocade Fabric OS administrative management API. When processing certificate management operations, user-supplied certificate identifiers are handled without adequate sanitization prior to execution in external system routines. An authenticated attacker with privileges to perform certificate deletion requests can leverage this flaw to execute arbitrary system commands with the privileges of the underlying management daemon. This vulnerability affects Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1.	Fabric Os
CVE-2026-94584	Oct 08, 2026	Race Condition in Brocade Fabric OS WebMgr Daemon before v10.0.1 A race condition and thread-safety vulnerability exists in the web management daemon of Brocade Fabric OS versions before 10.0.1. When handling user authentication requests across a multi-threaded execution pool, this race condition causes PAM modules to process stale or incorrect client IP addresses and switch context numbers. This leads to inaccurate audit records and potential access control bypasses where AAA evaluation or Calling-Station-ID ACL policies rely on client IP attributes.	Fabric Os
CVE-2026-94580	Oct 08, 2026	Brocade FabricOS <10.0.1: Arbitrary Delete via USB REST API An arbitrary file and directory deletion vulnerability exists in the REST API management interface handling USB storage operations on Brocade Fabric OS versions before 10.0.1. An authenticated user possessing USB management privileges can manipulate requested target paths to delete arbitrary files or directories on the switch's local root filesystem, bypassing intended USB mount point boundaries.	Fabric Os
CVE-2026-94575	Oct 08, 2026	Brocade FabricOS RBAC Bypass (Fix in 10.0.1) A logic vulnerability in Brocade Fabric OS versions before 10.0.1 web management framework allows an authenticated, low-privileged user to bypass inner Role-Based Access Control (RBAC) checks under specific environmental conditions. Successful exploitation lowers the system authorization mode for the active session context, allowing access to restricted configuration settings intended exclusively for administrative roles.	Fabric Os
CVE-2026-94583	Oct 08, 2026	Race Condition in Brocade Fabric OS REST MI (<=10.0.1) Exposes Config Data A race condition vulnerability exists in the request processing logic of the REST management interface on Brocade Fabric OS versions before 10.0.1. When handling concurrent incoming network management FCIP requests, a timing window exists between when a request populates the address variable and when the service constructs and returns the response context. As a result, the first request adopts the modified context, causing the service to return sensitive management details or configuration data belonging to the second context back to the original requester.	Fabric Os
CVE-2026-94582	Oct 08, 2026	Brocade Fabric OS FSPF internal diag buffer overflow before v10.0.1 A memory buffer overflow vulnerability exists in the internal diagnostic and route validation routines used by the Fabric Shortest Path First (FSPF) protocol component of Brocade Fabric OS versions before 10.0.1. While this code path is part of internal diagnostic functionality and is not directly accessible via standard user interfaces or CLI management commands, an input processing flaw allows incoming or internally routed diagnostic state payloads to exceed allocated memory boundaries. An attacker that is able to chain or link other vulnerabilities to exploit this internal diagnostic could cause a heap- or stack-based memory overrun, resulting in a daemon crash (Denial of Service) or potential arbitrary code execution within the context of the routing daemon.	Fabric Os
CVE-2026-87668	Oct 08, 2026	Brocade Fabric OS <10.0.1 Diagnostic Utility Buffer Overflow A stack-based buffer overflow vulnerability exists in the diagnostic execution utility of Brocade Fabric OS versions before 10.0.1. When processing command arguments for diagnostic operations, the utility tokenizes user-supplied input into an internal argument array without enforcing boundary checks on the maximum array capacity. An authenticated user with administrative access can exploit this vulnerability by supplying a crafted diagnostic command string containing an excessive number of tokenized arguments. This leads to a memory overwrite resulting in a denial of service (process crash).	Fabric Os
CVE-2026-87665	Oct 08, 2026	Brocade Fabric OS <10.0.1 IKEv2 SBVDoS via UDP 500 (Nonce) A stack-based buffer overflow vulnerability exists in the Internet Key Exchange (IKEv2) protocol handler on Brocade Fabric OS versions before 10.0.1. The vulnerability occurs when processing initial IKE key exchange requests on extension switches or blades running IPsec-enabled Fibre Channel over IP (FCIP) circuits. An unauthenticated remote attacker can exploit this vulnerability by sending a single, specifically crafted UDP packet (Port 500) containing an oversized Nonce payload. Successful exploitation results in a denial of service (data-plane process crash)	Fabric Os
CVE-2026-87672	Oct 08, 2026	Brocade Fabric OS <10.0.1 SupportLink Utility Exposes Proxy Credentials An information disclosure vulnerability exists in the SupportLink diagnostic collection utilities of Brocade Fabric OS versions before 10.0.1. When SupportLink is configured to use an authenticated HTTP proxy, the system stores the full proxy URL. Anyone with access to the diagnostic support bundle, such as support personnel or users with access to file shares where support bundles are stored, can extract these cleartext proxy credentials.	Fabric Os
CVE-2026-87670	Oct 08, 2026	Brocade Fabric OS <10.0.1 REST API Gateway Authorization Bypass An authorization logic vulnerability exists in the Brocade Fabric OS versions before 10.0.1 REST API gateway. The internal gate guarding restricted management endpoints relies exclusively on client-controlled HTTP headers. An authenticated user with any valid REST session can spoof these headers to gain unauthorized access to internal management endpoints. This allows low-privilege users to view sensitive chassis metadata, hardware memory patrolling state, and firmware integrity audit logs.	Fabric Os
CVE-2026-87669	Oct 08, 2026	Brocade Fabric OS <=10.0.1 REST API Missing Auth: Full MAPS Data Dump A missing authorization check in Brocade Fabric OS versions before 10.0.1 REST API interface of affected platform releases allows an authenticated user, regardless of their assigned role or administrative scope, to retrieve complete Monitoring and Alerting Policy Suite (MAPS) violation data across all logical switches. An attacker with low-privilege API access can leverage this endpoint to dump chassis-wide system health metrics, port performance violations, and configuration data without appropriate privileges.	Fabric Os
CVE-2026-87678	Oct 08, 2026	Brocade Fabric OS<10.0.1: Web Mgt Interface XSS via FA IdP Issuer An input validation and output encoding vulnerability exists in the web management interface of Brocade Fabric OS versions before 10.0.1. When configuring Federated Authentication (FA), the system fails to sanitize the Identity Provider (IdP) issuer parameter. An authenticated administratoror an attacker capable of supplying crafted FA configuration files during an import routinecan inject arbitrary web server directives. This can lead to service denial by preventing the web management daemon from starting, or potentially alter web server security controls.	Fabric Os