CVE-2025-1976: Broadcom Brocade Fabric OS Code Injection Vulnerability
Vulnerability summary
CVE-2025-1976 is a high (CVSS 8.6) Code Injection vulnerability in Broadcom Brocade Fabric OS. It is known to be exploited: CISA lists it, first on 28-04-2025. EPSS estimates a 0.69% chance of exploitation in the next 30 days, higher than 51.8% of scored vulnerabilities.
Timeline
- 24-04-2025PublishedVulnerability first disclosed.
- 28-04-2025Added to CISA KEVBroadcom Brocade Fabric OS Code Injection Vulnerability
- 19-05-2025CISA remediation dueApply mitigations per vendor instructions.
- 26-02-2026Last modifiedVulnerability information updated.
Description
Brocade Fabric OS versions starting with 9.1.0 have root access removed, however, a local user with admin privilege can potentially execute arbitrary code with full root privileges on Fabric OS versions 9.1.0 through 9.1.1d6.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST8.6HighCVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
0.69%
Chance of exploitation in the next 30 days
Percentile
52%
Versus all other CVEs
30-day change
0.00 pp
From 0.69% on 18-09-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 28-04-2025
- Federal due date
- 19-05-2025
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. support.broadcom.com/web/… nvd.nist.gov/vuln/detail/CVE-2025-1976
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
- CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Affected systems
Broadcom1 product
- fabric_operating_system≥ 9.1.0, < 9.1.1d7
Brocade1 product
- fabric_osFabric OS versions 9.1.0 through 9.1.1d6
2 vendors · 2 products
References
2 links- support.broadcom.com/web/…Vendor Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-1976Government ResourceUS Government Resource