CVE-2025-1976

Broadcom Brocade Fabric OS Code Injection Vulnerability

Broadcom Brocade Fabric OS

CVSS

8.6High

ExploitationExploited in the wildAdded to KEV 28 Apr 2025CISA KEV

Exploit odds (EPSS)0.69%Chance of exploitation activity in the next 30 days, higher than 52% of CVEs. Scored 23 Oct 2026FIRST EPSS

Fixed inNone listedNo source names a fixed version. Check the vendor advisory below

Federal deadline19 May 2025Remediation due date for US federal agenciesCISA KEV

CISA required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. CISA KEV

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Timeline

24 Apr 2025, 02:55 UTCPublishedCVE List
28 Apr 2025Added to CISA KEVCISA KEV

Description

Broadcom Brocade Fabric OS contains a code injection vulnerability that allows a local user with administrative privileges to execute arbitrary code with full root privileges.

Text from CVE List

Affected versions 1

Fabric OSaffected: Fabric OS versions 9.1.0 through 9.1.1d6CVE List