---
title: "Brocade Fabric OS CVE-2025-1976: Exploited Admin-to-Root Bug"
url: https://erroneo.us/security/briefs/brocade-fabric-os-cve-2025-1976-admin-to-root/
description: "Brocade SAN switches on Fabric OS 9.1.0 to 9.1.1d6 let an admin run code as root; exploited in 2025. Fixed in 9.1.1d7; 9.2.0+ unaffected. Check firmware."
type: security-brief
section: "Security Digest"
date_published: 2025-04-17
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2025-1976"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Brocade Fabric OS CVE-2025-1976: Exploited Admin-to-Root Bug

**Verdict: Check exposure.** Only Brocade SAN switches still on Fabric OS 9.1.0 through 9.1.1d6 need work: upgrade to 9.1.1d7 or a 9.2.x release and review who holds admin accounts.

- **Who must act:** Storage and infrastructure teams running Brocade switches, directors or extension switches on Fabric OS 9.1.0 through 9.1.1d6, and those on pre-9.1 releases where admins can reach root by design.
- **Who can relax:** Switches on Fabric OS 9.1.1d7 or 9.2.0 and later, and Brocade SANnav and ASCG, which Broadcom says are not affected.
- **Affected:** Brocade Fabric OS 9.1.0 through 9.1.1d6
- **Fixed:** Brocade Fabric OS 9.1.1d7; Brocade Fabric OS 9.2.0 and later (not affected)
- **CVEs:** CVE-2025-1976
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Run firmwareshow on every Brocade switch and director to record the Fabric OS version.
2. Upgrade anything on 9.1.0 through 9.1.1d6 to 9.1.1d7 or a current 9.2.x release.
3. Plan upgrades for switches below 9.1.0, where Broadcom says the admin role can access root directly.
4. Audit admin-level accounts with userconfig --show -a, remove unused ones and rotate passwords.
5. Limit management access to an admin network with ipfilter and send logs to central syslog.

### How to check if you are affected

- Review RASLog (errdump) and audit logs for admin logins from unexpected sources or at odd times.
- Check firmwareshow --history and account lists for firmware changes or admin users nobody can explain.
- If tampering is suspected, preserve logs and ask Broadcom support to help verify and reinstall the firmware.

## What happened

On April 17, 2025, Broadcom published [BSA-2025-2930](https://web.archive.org/web/20260906012656/https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25602) for CVE-2025-1976 in Brocade Fabric OS (FOS), the operating system on Brocade Fibre Channel SAN switches and directors. Starting with 9.1.0, FOS has root access removed. A flaw in IP address validation breaks that boundary. A local user with a predefined admin role, or a custom role with admin-level privileges, can run arbitrary code as root.

Broadcom says the bug lets that user "execute any existing Fabric OS command" or "modify the Fabric OS itself, including adding their own subroutines." It adds that, even though an attacker first needs admin access, "this vulnerability has been actively exploited in the field." CISA added the CVE to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-1976) on April 28, 2025, with a May 19 federal deadline. Neither Broadcom nor CISA has said who exploited it or against whom, and [The Hacker News](https://thehackernews.com/2025/04/cisa-adds-actively-exploited-broadcom.html) found no public details; that remains the case as of Oct 23, 2026. CISA lists ransomware use as unknown.

Broadcom scores it CVSS 4.0 8.6 and rates it critical. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-1976) gives CVSS 3.1 6.7, reflecting the high privileges required.

## Who is affected

Fabric OS 9.1.0 through 9.1.1d6 on Brocade switches, directors and extension switches. The fix is **9.1.1d7**; FOS 9.2.0 and later are not affected, nor are Brocade SANnav and ASCG. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2025-1976) matches. Note that 9.1.1d6 is the last vulnerable build, not the fix. OEM-branded Brocade switches also run FOS, so check the build your OEM supplies.

Older releases are a separate problem. Broadcom notes that FOS versions before 9.1.0 "allow the switch ADMIN role to directly access root." They are not listed as affected because there is no boundary to bypass, and Broadcom recommends moving to a release that removes root access.

## Do you really need to act?

Only if you run an affected build. An attacker needs a working admin login on the switch first, so this is a post-compromise step, not an entry point. That step still matters. SAN switches sit beneath your storage, cannot run endpoint agents, and root lets an attacker modify Fabric OS itself. If you are on 9.1.1d7 or 9.2.x, you are done. If you are on 9.1.0 through 9.1.1d6, schedule the upgrade now and treat the admin accounts as the real exposure.

## What to do now

1. On each switch, run `firmwareshow` and record the version.
2. Upgrade 9.1.0 to 9.1.1d6 to 9.1.1d7 or a current 9.2.x release with `firmwaredownload`, following Broadcom's upgrade path for your platform.
3. List accounts with `userconfig --show -a`. Remove unused admin-level users, rotate passwords, and prefer central RADIUS, LDAP or TACACS+ authentication.
4. Restrict management access to an admin network with `ipfilter`, and forward logs to central syslog (`syslogadmin --show -ip` shows the current targets).
5. Plan upgrades for anything below 9.1.0, where admin already means root.

## How to tell if you were hit

Broadcom has published no indicators of compromise. Start with access. Review RASLog (`errdump`) and your syslog archive for admin logins from unexpected hosts or at unusual times. Check `firmwareshow --history` for firmware changes nobody scheduled, and compare the account list against your records. Because root access lets an attacker modify FOS itself, a clean-looking switch is not proof. If anything looks off, preserve the logs and work with Broadcom support to verify and reinstall the firmware, then rotate every credential that touched the switch.

## Timeline

- Apr 17, 2025 — Broadcom publishes BSA-2025-2930 with the fix in 9.1.1d7.
- Apr 24, 2025 — CVE-2025-1976 is published.
- Apr 28, 2025 — CISA adds the CVE to KEV.
- Apr 30, 2025 — Broadcom last updates the advisory.
- May 19, 2025 — CISA's remediation deadline for federal agencies.

## Sources

1. [Broadcom — BSA-2025-2930: Code injection exposure in Fabric OS 9.1.0 through 9.1.1d6 (archived copy, Sep 6, 2026)](https://web.archive.org/web/20260906012656/https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25602)
2. [CVE record — CVE-2025-1976](https://www.cve.org/CVERecord?id=CVE-2025-1976)
3. [NVD — CVE-2025-1976](https://nvd.nist.gov/vuln/detail/CVE-2025-1976)
4. [CISA — Known Exploited Vulnerabilities: CVE-2025-1976](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-1976)
5. [The Hacker News — CISA Adds Actively Exploited Broadcom and Commvault Flaws to KEV Database](https://thehackernews.com/2025/04/cisa-adds-actively-exploited-broadcom.html)

---
Source page: https://erroneo.us/security/briefs/brocade-fabric-os-cve-2025-1976-admin-to-root/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt