CVE-2025-1976

Description

Brocade Fabric OS versions starting with 9.1.0 have root access removed, however, a local user with admin privilege can potentially execute arbitrary code with full root privileges on Fabric OS versions 9.1.0 through 9.1.1d6.

Scoring

• CVSS: 6.7 (MEDIUM, 3.1)
• EPSS exploitation probability: Not yet available
• EPSS percentile: Not yet available

CISA KEV status

• Added to KEV: 2025-04-28
• Remediation due date: 2025-05-19
• Known ransomware campaign use: Unknown

Weakness types (CWE)

• CWE-94
• CWE-78

References

• https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25602
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-1976

More from Broadcom

• CVE-2026-41709 — VMware ESX
• CVE-2026-59310 — VMware vCenter
• CVE-2026-22719 — VMware Aria Operations
• CVE-2024-37079 — VMware vCenter Server
• CVE-2025-41244 — VMware Aria Operations and VMware Tools