CVE-2025-1976

MediumCVSS 6.7/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Brocade Fabric OS versions starting with 9.1.0 have root access removed, however, a local user with admin privilege can potentially execute arbitrary code with full root privileges on Fabric OS versions 9.1.0 through 9.1.1d6.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94 CWE-78

Affected software

Vendor	Product	Versions
Brocade	Fabric OS	Fabric OS versions 9.1.0 through 9.1.1d6

References

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25602Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-1976US Government Resource

Timeline

Published: Apr 24, 2025
Last modified: Jun 17, 2026
Added to CISA KEV: Apr 28, 2025
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-19777.7The NPort 6100-G2/6200-G2 Series is affected by an execution with unnecessary privileges vulnerability (CVE-2025-1977) that allows an authen CVE-2025-19789.8Remote Code Execution Vulnerability in Hitachi Storage Navigator and the maintenance console in Hitachi Virtual Storage Platform G130, G150,CVE-2025-19796.4Versions of the package ray before 2.43.0 are vulnerable to Insertion of Sensitive Information into Log File where the redis password is bei CVE-2025-19809.4The Ready_ application's Profile section allows users to upload files of any type and extension without restriction. If the server is miscon CVE-2025-19819.4Improper neutralization of input provided by a low-privileged user into a file search functionality in Ready_'s Invoices module allows for S CVE-2025-19827.1Local File Inclusion vulnerability in Ready's attachment upload panel allows low privileged user to provide link to a local file using the f CVE-2025-19835.1A cross-site scripting (XSS) vulnerability in Ready_'s File Explorer upload functionality allows injection of arbitrary JavaScript code in f CVE-2025-19845.2Xerox Desktop Print Experience application contains a Local Privilege Escalation (LPE) vulnerability, which allows a low-privileged user to CVE-2025-19856.1Due to improper neutralization of input during web page generation (XSS) an unauthenticated remote attacker can inject HTML code into the We CVE-2025-19864.1The Gutentor WordPress plugin before 3.4.7 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to CVE-2025-19876.1A Cross-Site Scripting (XSS) vulnerability has been identified in Psono-Client’s handling of vault entries of type website_password and book CVE-2025-19917.5IBM Informix Dynamic Server 12.10,14.10, and15.0 could allow a remote attacker to cause a denial of service due to an integer underflow when