Cybersecurity and US Infrastructure Agency (CISA) added Two high -speed security deficiencies affect Brouccom Brocade Tabric OS and Web Server Commvault, to known exploited vulnerabilities (Ship) Catalog, citing evidence of active exploitation in the wild.
The vulnerabilities in question are below –
- Cve-2015-1976 (CVSS assessment: 8.6) – a shortage of injection code that affects
- Cve-2025-3928 (CVSS Assessment: 8.7) -Unented Disadvantage on the Commvault Web -Server, which allows a remote, authentic striker to create and perform web
“Using this vulnerability requires a bad actor to authenticate users’ accounting data – Note in a recommendation published in February 2025.
“Invalid access is not exploited. For software customers, this means that your environment should be: (I) available through the Internet, (II) compromised through unrelated avenue, and (III) uses legitimate users’ powers.”
Vulnerability affects the following versions of Windows and Linux –
- 11.36.0 – 11.36.45 (secured at 11.36.46)
- 11.32.0 – 11.32.88 (enshrined at 11.32.89)
- 11.28.0 – 11.28.140 (secured at 11.28.141)
- 11.20.0 – 11.20.216 (recorded at 11.20.217)
As for the CVE-2025-1976, Broadcom said that due to the lack of IP checks, a local user with the privilege of the administrator can potentially execute the arbitrary code with the root privileges on the OS version 9.1.1.1d6. It was recorded in version 9.1.1D7.
“This vulnerability can allow the user to perform any fabric team or can also be used to modify the fabric itself, including the addition of their own sub -programs,” – Broadcom noted In the newsletter published on April 17, 2025.
“Despite the fact that the achievement of this feat first requires a true access to the role of administrator’s privileges, this vulnerability is actively used in the field.”
Currently, there are no public details about how one of the vulnerabilities, the scale of the attacks and which may be behind them, was used in the wild.
Federal Civil Executive Agency (FCEB) is recommended to apply the necessary patches for the Commvault web server until May 17, 2025, as well as May 19.
