CVE-2025-1976: high-severity vulnerability in Brocade Fabric OS
Code injection exposure in Fabric OS 9.1.0 through 9.1.1d6
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
An admin user on Brocade Fabric OS can run any code with root privileges, even though the system removed root access for regular users. This means a compromised or malicious admin account can take complete control of the system.
A code injection vulnerability exists in Brocade Fabric OS 9.1.0–9.1.1d6 where admin-privileged local users can bypass root access restrictions and execute arbitrary code with full root privileges. The attack requires valid admin credentials and local system access, granting unrestricted control over the affected device.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.