Brocade Fabric OS CVE-2025-1976: Exploited Admin-to-Root Bug

What to do

1. Run firmwareshow on every Brocade switch and director to record the Fabric OS version.
2. Upgrade anything on 9.1.0 through 9.1.1d6 to 9.1.1d7 or a current 9.2.x release.
3. Plan upgrades for switches below 9.1.0, where Broadcom says the admin role can access root directly.
4. Audit admin-level accounts with userconfig --show -a, remove unused ones and rotate passwords.
5. Limit management access to an admin network with ipfilter and send logs to central syslog.

How to check if you are affected or compromised

• Review RASLog (errdump) and audit logs for admin logins from unexpected sources or at odd times.
• Check firmwareshow --history and account lists for firmware changes or admin users nobody can explain.
• If tampering is suspected, preserve logs and ask Broadcom support to help verify and reinstall the firmware.

What happened#

On April 17, 2025, Broadcom published BSA-2025-2930 for CVE-2025-1976 in Brocade Fabric OS (FOS), the operating system on Brocade Fibre Channel SAN switches and directors. Starting with 9.1.0, FOS has root access removed. A flaw in IP address validation breaks that boundary. A local user with a predefined admin role, or a custom role with admin-level privileges, can run arbitrary code as root.

Broadcom says the bug lets that user "execute any existing Fabric OS command" or "modify the Fabric OS itself, including adding their own subroutines." It adds that, even though an attacker first needs admin access, "this vulnerability has been actively exploited in the field." CISA added the CVE to the KEV catalog on April 28, 2025, with a May 19 federal deadline. Neither Broadcom nor CISA has said who exploited it or against whom, and The Hacker News found no public details; that remains the case as of Oct 23, 2026. CISA lists ransomware use as unknown.

Broadcom scores it CVSS 4.0 8.6 and rates it critical. NVD gives CVSS 3.1 6.7, reflecting the high privileges required.

Who is affected#

Fabric OS 9.1.0 through 9.1.1d6 on Brocade switches, directors and extension switches. The fix is 9.1.1d7; FOS 9.2.0 and later are not affected, nor are Brocade SANnav and ASCG. The CVE record matches. Note that 9.1.1d6 is the last vulnerable build, not the fix. OEM-branded Brocade switches also run FOS, so check the build your OEM supplies.

Older releases are a separate problem. Broadcom notes that FOS versions before 9.1.0 "allow the switch ADMIN role to directly access root." They are not listed as affected because there is no boundary to bypass, and Broadcom recommends moving to a release that removes root access.

Do you really need to act?#

Only if you run an affected build. An attacker needs a working admin login on the switch first, so this is a post-compromise step, not an entry point. That step still matters. SAN switches sit beneath your storage, cannot run endpoint agents, and root lets an attacker modify Fabric OS itself. If you are on 9.1.1d7 or 9.2.x, you are done. If you are on 9.1.0 through 9.1.1d6, schedule the upgrade now and treat the admin accounts as the real exposure.

What to do now#

1. On each switch, run firmwareshow and record the version.
2. Upgrade 9.1.0 to 9.1.1d6 to 9.1.1d7 or a current 9.2.x release with firmwaredownload, following Broadcom's upgrade path for your platform.
3. List accounts with userconfig --show -a. Remove unused admin-level users, rotate passwords, and prefer central RADIUS, LDAP or TACACS+ authentication.
4. Restrict management access to an admin network with ipfilter, and forward logs to central syslog (syslogadmin --show -ip shows the current targets).
5. Plan upgrades for anything below 9.1.0, where admin already means root.

How to tell if you were hit#

Broadcom has published no indicators of compromise. Start with access. Review RASLog (errdump) and your syslog archive for admin logins from unexpected hosts or at unusual times. Check firmwareshow --history for firmware changes nobody scheduled, and compare the account list against your records. Because root access lets an attacker modify FOS itself, a clean-looking switch is not proof. If anything looks off, preserve the logs and work with Broadcom support to verify and reinstall the firmware, then rotate every credential that touched the switch.

Timeline#

• Apr 17, 2025 — Broadcom publishes BSA-2025-2930 with the fix in 9.1.1d7.
• Apr 24, 2025 — CVE-2025-1976 is published.
• Apr 28, 2025 — CISA adds the CVE to KEV.
• Apr 30, 2025 — Broadcom last updates the advisory.
• May 19, 2025 — CISA's remediation deadline for federal agencies.

Vulnerability records

• CVE-2025-1976 · KEV 2025-04-28 · Brocade Fabric OS versions starting with 9.1.0 have root access removed, however, a local user with admin privilege can potentially execute arbitrary code…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Broadcom — BSA-2025-2930: Code injection exposure in Fabric OS 9.1.0 through 9.1.1d6 (archived copy, Sep 6, 2026) web.archive.org
2. CVE record — CVE-2025-1976 cve.org
3. NVD — CVE-2025-1976 nvd.nist.gov
4. CISA — Known Exploited Vulnerabilities: CVE-2025-1976 cisa.gov

Coverage and analysis

1. The Hacker News — CISA Adds Actively Exploited Broadcom and Commvault Flaws to KEV Database thehackernews.com