U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Qualitia Active! Mail, Broadcom Brocade Fabric OS, and Commvault Web Server flaws to its Known Exploited Vulnerabilities catalog.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Qualitia Active! Mail, Broadcom Brocade Fabric OS, and Commvault Web Server flaws to its Known Exploited Vulnerabilities (KEV) catalog.
Below are the descriptions for these flaws:
- CVE-2025-1976 Broadcom Brocade Fabric OS Code Injection Vulnerability – In Brocade Fabric OS versions 9.1.0 to 9.1.1d6, although direct root access was officially removed, a local user with administrative privileges can still exploit a vulnerability to execute arbitrary code with full root privileges. This flaw effectively bypasses the intended security restrictions, allowing complete control over the system.
- CVE-2025-42599 is a Stack-Based Buffer Overflow Vulnerability in Qualitia Active! Mail. The flaw impacts Active! mail 6 BuildInfo: 6.60.05008561 and earlier. Receiving a specially crafted request created and sent by a remote unauthenticated attacker may lead to arbitrary code execution and/or a denial-of-service (DoS) condition.
- CVE-2025-3928 Commvault Web Server Unspecified Vulnerability. Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: “Webservers can be compromised through bad actors creating and executing webshells.” Fixed in version 11.36.46, 11.32.89, 11.28.141, and 11.20.217 for Windows and Linux platforms.
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts also recommend private organizations review the Catalog and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix the vulnerabilities CVE-2025-1976 and CVE-2025-42599 by May 19, 2025. CISA orders federal agencies to fix the vulnerability CVE-2025-3928 by May 17, 2025.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CISA)
