CISA Adds Actively Exploited Broadcom and Commvault Flaws to KEV Database

CVE-2025-1976 is a code/command injection flaw (CWE-94, CWE-78) in Broadcom Brocade Fabric OS, the operating system running on Brocade fibre-channel SAN switches. Starting with Fabric OS 9.1.0, root access was removed from administrators, but on versions 9.1.0 through 9.1.1d6 a local user with admin privileges can inject and execute arbitrary code to run with full root privileges. The CVSS 4.0 vector (AV:A/PR:L) indicates the attacker needs adjacent access with admin-level credentials and no user interaction, and successful exploitation grants complete root control of the switch, potentially compromising SAN fabric operations and enabling persistence in the storage network. Any organization running Brocade switches on the affected Fabric OS 9.1.0–9.1.1d6 range is exposed. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2025-04-28, confirming active exploitation; no public PoC is known and EPSS puts 30-day exploitation probability at 0.7%.

Do: Upgrade Brocade Fabric OS to a release later than 9.1.1d6 following Brocade's security advisory; because the affected range ends at 9.1.1d6, any switch on 9.1.0–9.1.1d6 should be treated as vulnerable. Until patched, restrict admin CLI/SSH/API access to trusted administrators, audit admin accounts and CLI logs for signs of misuse, and hunt for unexpected code execution on switches. U.S. federal agencies must apply vendor mitigations or discontinue use per BOD 22-01 timelines, given the KEV listing.

CVE-2025-3928 is an unspecified vulnerability in the Commvault Web Server, the web administration component of Commvault's data protection platform, which can be exploited over the network by a remote attacker who holds valid (low-privilege) authenticated access. According to the Commvault advisory, attackers use the flaw to create and execute webshells on the web server, and the CVSS 4.0 score of 8.7 (High) reflects high impact to the confidentiality, integrity, and availability of the vulnerable web server component. It affects Commvault Web Server on both Windows and Linux across the supported release streams, with fixes delivered in 11.36.46, 11.32.89, 11.28.141, and 11.20.217. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2025-04-28, and Commvault has confirmed that hackers exploited it in the wild as a zero-day, with related reporting noting heightened Silk Typhoon (Chinese nation-state) attack activity. No public proof-of-concept is known, but the confirmed real-world zero-day exploitation makes patching urgent.

Do: Upgrade the Commvault Web Server to 11.36.46, 11.32.89, 11.28.141, or 11.20.217, matching your current release stream, on both Windows and Linux platforms. Because the flaw was exploited as a zero-day, hunt for attacker-created webshells and unexpected accounts, scripts, or scheduled tasks on Commvault web server hosts, review authentication logs for suspicious logins, and restrict the Commvault web interface to trusted networks. Federal agencies must apply vendor mitigations per CISA instructions or follow BOD 22-01 guidance for cloud services, or discontinue use if mitigations are unavailable.