CISA Adds Actively Exploited Broadcom and Commvault Flaws to KEV Database

Apr 29, 2025Ravie LakshmananVulnerability / Web Security

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added two high-severity security flaws impacting Broadcom Brocade Fabric OS and Commvault Web Server to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in the wild.

The vulnerabilities in question are listed below –

• CVE-2025-1976 (CVSS score: 8.6) – A code injection flaw affecting Broadcom Brocade Fabric OS that allows a local user with administrative privileges to execute arbitrary code with full root privileges
• CVE-2025-3928 (CVSS score: 8.7) – An unspecified flaw in the Commvault Web Server that allows a remote, authenticated attacker to create and execute web shells

“Exploiting this vulnerability requires a bad actor to have authenticated user credentials within the Commvault Software environment,” Commvault said in an advisory released in February 2025.

“Unauthenticated access is not exploitable. For software customers, this means your environment must be: (i) accessible via the internet, (ii) compromised through an unrelated avenue, and (iii) accessed leveraging legitimate user credentials.”

The vulnerability affects the following Windows and Linux versions –

• 11.36.0 – 11.36.45 (Fixed in 11.36.46)
• 11.32.0 – 11.32.88 (Fixed in 11.32.89)
• 11.28.0 – 11.28.140 (Fixed in 11.28.141)
• 11.20.0 – 11.20.216 (Fixed in 11.20.217)

As for CVE-2025-1976, Broadcom said that due to a flaw in IP Address validation, a local user with the admin privilege can potentially execute arbitrary code with root privileges on Fabric OS versions 9.1.0 through 9.1.1d6. It has been fixed in version 9.1.1d7.

“This vulnerability can allow the user to execute any existing Fabric OS command or can also be used to modify the Fabric OS itself, including adding their own subroutines,” Broadcom noted in a bulletin published on April 17, 2025.

“Even though achieving this exploit first requires valid access to a role with admin privileges, this vulnerability has been actively exploited in the field.”

There are currently no public details on how either of the vulnerabilities have been exploited in the wild, the scale of the attacks, and who may be behind them.

Federal Civilian Executive Branch (FCEB) agencies are recommended to apply the necessary patches for the Commvault Web Server by May 17, 2025, and Broadcom Brocade Fabric OS by May 19, respectively.