CVE-2025-1976

Code injection exposure in Fabric OS 9.1.0 through 9.1.1d6

MEDIUM

6.7

CVSS Score

Published: April 24, 2025 at 02:55 AM UTC

Updated: June 17, 2026 at 08:40 AM UTC

1 product affected across 1 vendorFabric Operating System

Using Fabric OS by Brocade?

Get instant alerts when new vulnerabilities affect Fabric OS - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM6.7

Exploitation

CISA KEV

Exploit prediction

EPSS 0.7%

SSVC

Active

Actively Exploited

CISA Known Exploited Vulnerabilities (KEV) Catalog

EPSS Score0.7%

EPSS (Exploit Prediction Scoring System) estimates a 0.7% chance this CVE is exploited in the wild within the next 30 days — higher than 53% of all CVEs. It complements CVSS: a high EPSS on a mid-severity CVE can still be urgent.

Broadcom Brocade Fabric OS contains a code injection vulnerability that allows a local user with administrative privileges to execute arbitrary code with full root privileges.

Required Action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Ransomware Use

Unknown

Added to KEV

Apr 28, 2025

Remediation Due

May 19, 2025

525 days overdue

Notes

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25602

https://nvd.nist.gov/vuln/detail/CVE-2025-1976

Description

Brocade Fabric OS versions starting with 9.1.0 have root access removed, however, a local user with admin privilege can potentially execute arbitrary code with full root privileges on Fabric OS versions 9.1.0 through 9.1.1d6.