DaystoPatch

Broadcom (VMware)Exploited incident

Brocade Fabric OS code injection by admin users (BSA-2025-2930)

CVE-2025-1976High, CVSS 8.6In CISA's Known Exploited Vulnerabilities catalog since 28 Apr 2025

FixedFixed for every supported version on the day it became public.

Response

Silence
same day
First public report to first vendor statement
Exposure
same day
First public report to first fix
Follow-through
same day
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    date only

    Broadcom/Brocade security advisory BSA-2025-2930, notification 25602 (Wayback snapshot 2025-04-22)CuratedQuote verified

    Even though achieving this exploit first requires valid access to a role with admin privileges, this vulnerability has been actively exploited in the field.

    Exploitation disclosed in the advisory itself ('Initial Publication Date 17 April 2025'). No earlier public report found.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:095fa6bb4a6ef0a6…
    Used in metrics
    Yes
    Dispute this timestamp
    3 more sources for this moment
    Bluesky postClaimedQuote not checked yet22 Apr 2025, 07:47 UTC

    Critical CVE-2025-1976 Vulnerability in Brocade Fabric OS Actively Exploited

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2025-1976ClaimedQuote verified24 Apr 2025, 02:55 UTC

    Brocade Fabric OS versions starting with 9.1.0 have root access removed, however, a local user with admin privilege can potentially execute arbitrary code with full root privileges on Fabric OS

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:0c4eeabf73b748d3…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2025-1976)ClaimedQuote verified28 Apr 2025

    Broadcom Brocade Fabric OS Code Injection Vulnerability

    Added to CISA's KEV catalog on 2025-04-28.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    date onlysame day

    Broadcom/Brocade security advisory BSA-2025-2930 (Wayback snapshot 2025-04-22)CuratedQuote verified

    Initial Publication

    Revision history row '1.0 Initial Publication April 17, 2025'; the header shows 'Initial Publication Date 17 April 2025'.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:095fa6bb4a6ef0a6…
    Used in metrics
    Yes
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    date onlysame day

    Broadcom/Brocade security advisory BSA-2025-2930 (Wayback snapshot 2025-04-22)CuratedQuote verified

    Security update provided in Brocade Fabric OS 9.1.1d7

    Upper bound: fixed builds may have shipped earlier. Broadcom's release-notes digest 'FOS-911d-RN' (covering v9.1.1d, v9.1.1d2 and v9.1.1d7) is indexed by search engines as dated 2025-04-03, two weeks before this advisory, but docs.broadcom.com returns 404 to automated requests and the only Wayback capture (2025-07-10) is an empty viewer page, so that date cannot be verified or quoted. Broadcom's 'Fabric OS (9.x Release) Vulnerability Disclosures' page (notification 25000) lists only the advisory posting date (April 17, 2025).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:095fa6bb4a6ef0a6…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    date onlysame day

    Broadcom/Brocade security advisory BSA-2025-2930 (Wayback snapshot 2025-04-22)CuratedQuote verified

    Brocade Fabric OS versions 9.2.0 and later

    Listed under 'Products Not Affected'; only the 9.1.x line is affected, fixed in 9.1.1d7. Versions before 9.1.0 already allow admins root access by design, and Brocade recommends moving off them.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:095fa6bb4a6ef0a6…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • Brocade Fabric OS 9.1.0 through 9.1.1d6 (Brocade directors and switches)
How we built this timeline

AUDIT 2 (23 Oct 2026): exploited before a fix changed true -> null. The only retrievable evidence dates the fix to the advisory (17 Apr 2025), which also reports exploitation ('has been actively exploited in the field'), so on that evidence exploitation preceded or coincided with the fix.

But the FOS 9.1.1d release-notes digest that adds 9.1.1d7 is indexed as dated 3 Apr 2025; if so, the fix was public two weeks before any public evidence of exploitation and R4 gives false. The two pieces of evidence conflict on the ordering and the release notes cannot be retrieved (docs.broadcom.com 404 to bots, no Wayback copy), so null.

Searched: docs.broadcom.com FOS-911d-RN (live and Wayback), Broadcom notification 25000, OEM (HPE, Lenovo, Dell) release notes, web search. Exploitation requires an existing admin-level account.

Severity follows Broadcom's CVSS 4.0 base score 8.6 (High), although the portal header labels the notification 'CRITICAL'. Brocade is a Broadcom business, mapped to broadcom-vmware via KEV vendorProject 'Broadcom'.

Related

No related incidents.

Broadcom (VMware) report card