CVE-2025-1976: Brocade Fabric OS admin-to-root code injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityIt is in CISA KEV with a near-term remediation deadline and gives root-level code execution, though it requires an existing admin account and adjacent access.

What it is

Brocade Fabric OS 9.1.0 through 9.1.1d6 removed direct root access, but a local user with admin privilege can execute arbitrary code with full root privileges. This lets a privileged operator escalate to root on the switch, breaking the intended privilege separation.

Impact

An attacker with an existing admin account gains full root-level code execution on the Fabric OS device. That allows complete control of the switch, including configuration, data and any credentials or fabric operations it handles.

Attack surface

Reached locally on the device by an authenticated user holding admin privilege; the CVSS 4.0 vector is AV:A/PR:L/UI:N, so it is adjacent access with low privileges required and no user interaction.

Exploitation

CVE-2025-1976 is listed in CISA KEV with a 2025-05-19 remediation due date, indicating known exploitation, while EPSS is low at 0.00694 (51st percentile). No ransomware campaign use is documented.

What to do

• Apply the Broadcom Brocade Fabric OS update that fixes the code injection; follow the vendor advisory for the correct fixed release.
• If patching is not immediately possible, follow CISA KEV required action and vendor instructions, or discontinue use of the affected product.
• Restrict and audit admin-privileged accounts on Fabric OS devices; remove unnecessary admin users and enforce least privilege.
• Limit management access to trusted, adjacent network segments and monitor for unexpected local command execution.
• Track the CISA KEV due date (2025-05-19) and confirm remediation before it passes.

Detection

• Audit Fabric OS logs for admin sessions spawning unexpected shell or command execution activity.
• Alert on new or modified local accounts and privilege changes on Fabric OS devices.
• Monitor for anomalous commands or process behavior originating from admin sessions on switches.
• Review authentication and command audit logs for admin activity outside normal change windows.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.