Broadcom

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Broadcom product.

RSS Feeds for Broadcom security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Broadcom products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Broadcom Sorted by Most Security Vulnerabilities since 2018

Broadcom Fabric Operating System79 vulnerabilities

Broadcom Brocade Sannav43 vulnerabilities

Broadcom Tcpreplay43 vulnerabilities

Broadcom Brocade Fabric Operating System Firmware27 vulnerabilities

Broadcom Raid Controller Web Interface22 vulnerabilities

Broadcom Sannav18 vulnerabilities

Broadcom Lsi Storage Authority18 vulnerabilities

Broadcom Advanced Secure Gateway16 vulnerabilities

Broadcom Rabbitmq Server12 vulnerabilities

Broadcom Brocade Fabric Operating System11 vulnerabilities

Broadcom Symantec Data Center Security Server7 vulnerabilities

Broadcom Symantec Messaging Gateway6 vulnerabilities

Broadcom Symantec Identity Governance Administration6 vulnerabilities

Broadcom Unified Infrastructure Management4 vulnerabilities

Broadcom Content Analysis4 vulnerabilities

Broadcom Symantec Endpoint Protection4 vulnerabilities

Broadcom Vmware Nsx3 vulnerabilities

Broadcom Symantec Identity Manager3 vulnerabilities

Broadcom Vmware Nsx T Data Center3 vulnerabilities

Broadcom Symantec Privileged Access Management2 vulnerabilities

Broadcom Vmware Cloud Foundation2 vulnerabilities

Known Exploited Broadcom Vulnerabilities

The following Broadcom vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.

Title	Description	Added
Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability	Broadcom VMware Aria Operations and VMware Tools contain a privilege defined with unsafe actions vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM. CVE-2025-41244 Exploit Probability: 1.4%	October 30, 2025
Broadcom Brocade Fabric OS Code Injection Vulnerability	Broadcom Brocade Fabric OS contains a code injection vulnerability that allows a local user with administrative privileges to execute arbitrary code with full root privileges. CVE-2025-1976 Exploit Probability: 0.7%	April 28, 2025

By the Year

In 2025 there have been 16 vulnerabilities in Broadcom with an average score of 7.9 out of ten. Last year, in 2024 Broadcom had 47 security vulnerabilities published. Right now, Broadcom is on track to have less security vulnerabilities in 2025 than it did last year. However, the average CVE base score of the vulnerabilities in 2025 is greater by 0.87.

Year	Vulnerabilities	Average Score
2025	16	7.93
2024	47	7.06
2023	60	6.81
2022	62	7.48
2021	46	6.86
2020	48	7.28
2019	33	7.38
2018	44	7.52

It may take a day or so for new Broadcom vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Broadcom Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2025-10847	Oct 01, 2025	Nimsoft UIM Robot ACL Bypass Enables Remote Cmd Exec DX Unified Infrastructure Management (Nimsoft/UIM) and below contains an improper ACL handling vulnerability in the robot (controller) component. A remote attacker can execute commands, read from, or write to the target system.	Unified Infrastructure Management
CVE-2025-9059	Sep 11, 2025	Altiris Core Agent Updater DLL Hijacking Elevation of Privileges The Altiris Core Agent Updater package (AeXNSC.exe) is prone to an elevation of privileges vulnerability through DLL hijacking.
CVE-2025-4662	Jul 10, 2025	Brocade SANnav <2.4.0a logs plaintext passphrases in audit logs Brocade SANnav before SANnav 2.4.0a logs plaintext passphrases in the Brocade SANnav host server audit logs while executing OpenSSL command using a passphrase from the command line or while providing the passphrase through a temporary file. These audit logs are the local server VMs audit logs and are not controlled by SANnav. These logs are only visible to the server admin of the host server and are not visible to the SANnav admin or any SANnav user.	Sannav
CVE-2025-50200	Jun 19, 2025	RabbitMQ <=3.13.7 API Logs Expose Base64 Auth Headers RabbitMQ is a messaging and streaming broker. In versions 3.13.7 and prior, RabbitMQ is logging authorization headers in plaintext encoded in base64. When querying RabbitMQ api with HTTP/s with basic authentication it creates logs with all headers in request, including authorization headers which show base64 encoded username:password. This is easy to decode and afterwards could be used to obtain control to the system depending on credentials. This issue has been patched in version 4.0.8.	Rabbitmq Server
CVE-2025-25215	Jun 13, 2025	Arbitrary Free via cv_close in Dell ControlVault3 <5.15.10.14 An arbitrary free vulnerability exists in the cv_close functionality of Dell ControlVault3 prior to 5.15.10.14 and Dell ControlVault3 Plus prior to 6.2.26.36. A specially crafted ControlVault API call can lead to an arbitrary free. An attacker can forge a fake session to trigger this vulnerability.
CVE-2025-24919	Jun 13, 2025	Dell ControlVault3 Deserialization via cvhDecapsulateCmd (pre-5.15.10.14 / pre-6.2.26.36) A deserialization of untrusted input vulnerability exists in the cvhDecapsulateCmd functionality of Dell ControlVault3 prior to 5.15.10.14 and ControlVault3 Plus prior to 6.2.26.36. A specially crafted ControlVault response to a command can lead to arbitrary code execution. An attacker can compromise a ControlVault firmware and have it craft a malicious response to trigger this vulnerability.
CVE-2025-25050	Jun 13, 2025	OOB Write in Dell ControlVault3 API (cv_upgrade_sensor_firmware) pre 5.15.10.14 An out-of-bounds write vulnerability exists in the cv_upgrade_sensor_firmware functionality of Dell ControlVault3 prior to 5.15.10.14 and Dell ControlVault 3 Plus prior to 6.2.26.36. A specially crafted ControlVault API call can lead to an out-of-bounds write. An attacker can issue an API call to trigger this vulnerability.
CVE-2025-24922	Jun 13, 2025	Dell ControlVault3 Buffer Overflow in securebio_identify <5.15.10.14/6.2.26.36 A stack-based buffer overflow vulnerability exists in the securebio_identify functionality of Dell ControlVault3 prior to 5.15.10.14 and Dell ControlVault3 Plus prior to 6.2.26.36. A specially crafted malicious cv_object can lead to a arbitrary code execution. An attacker can issue an API call to trigger this vulnerability.
CVE-2025-24311	Jun 13, 2025	OOB Read in Dell ControlVault3 (<5.15.10.14) & Plus (<6.2.26.36) via API An out-of-bounds read vulnerability exists in the cv_send_blockdata functionality of Dell ControlVault3 prior to 5.15.10.14 and Dell ControlVault3 Plus prior to 6.2.26.36. A specially crafted ControlVault API call can lead to an information leak. An attacker can issue an API call to trigger this vulnerability.
CVE-2025-22243	Jun 04, 2025	VMware NSX Manager UI XSS: Improper Input Validation VMware NSX Manager UI is vulnerable to a stored Cross-Site Scripting (XSS) attack due to improper input validation.	Vmware Nsx
CVE-2025-22244	Jun 04, 2025	VMware NSX Stored XSS in Gateway Firewall VMware NSX contains a stored Cross-Site Scripting (XSS) vulnerability in the gateway firewall due to improper input validation.	Vmware Nsx
CVE-2025-22245	Jun 04, 2025	VMware NSX Router Port Stored XSS via Improper Input Validation VMware NSX contains a stored Cross-Site Scripting (XSS) vulnerability in the router port due to improper input validation.	Vmware Nsx
CVE-2024-22654	May 29, 2025	Infinite Loop in tcpreplay v4.4.4 via tcprewrite (get.c) tcpreplay v4.4.4 was discovered to contain an infinite loop via the tcprewrite function at get.c.	Tcpreplay
CVE-2025-22248	May 13, 2025	Bitnami Pgpool/PGHA: Unauthenticated repmgr User Enables DB Access The bitnami/pgpool Docker image, and the bitnami/postgres-ha k8s chart, under default configurations, comes with an 'repmgr' user that allows unauthenticated access to the database inside the cluster. The PGPOOL_SR_CHECK_USER is the user that Pgpool itself uses to perform streaming replication checks against nodes, and should not be at trust level. This allows to log into a PostgreSQL database using the repgmr user without authentication. If Pgpool is exposed externally, a potential attacker could use this user to get access to the service. This is also present within the bitnami/postgres-ha Kubernetes Helm chart.	Bitnami Bitnami Popool Bitnamipgpool And others...
CVE-2025-3599	Apr 30, 2025	Symantec Endpoint Protection Windows Agent EoP via ERASER Engine <119.1.7.8 Symantec Endpoint Protection Windows Agent, running an ERASER Engine prior to 119.1.7.8, may be susceptible to an Elevation of Privilege vulnerability, which may allow an attacker to delete resources that are normally protected from an application or user.	Symantec Endpoint Protection
CVE-2025-1976	Apr 24, 2025	Brocade Fabric OS 9.1.0–9.1.1d6 Local Admin Arbitrary Code Exec Brocade Fabric OS versions starting with 9.1.0 have root access removed, however, a local user with admin privilege can potentially execute arbitrary code with full root privileges on Fabric OS versions 9.1.0 through 9.1.1d6.	Fabric Operating System
CVE-2024-10403	Nov 21, 2024	Brocade Fabric OS SFTP/FTP Server Password Exposure in Core Dump Brocade Fabric OS versions before 8.2.3e2, versions 9.0.0 through 9.2.0c, and 9.2.1 through 9.2.1a can capture the SFTP/FTP server password used for a firmware download operation initiated by SANnav or through WebEM in a weblinker core dump that is later captured via supportsave.	Fabric Operating System
CVE-2022-43937	Nov 21, 2024	Brocade SANnav: Information Exposure via Debug Logs Possible information exposure through log file vulnerability where sensitive fields are recorded in the debug-enabled logs when debugging is turned on in Brocade SANnav before 2.3.0 and 2.2.2a	Brocade Sannav
CVE-2022-43936	Nov 21, 2024	Brocade SANnav Password Logging Vulnerability in Brocade Fabric OS Brocade SANnav versions before 2.2.2 log Brocade Fabric OS switch passwords when debugging is enabled.	Brocade Sannav
CVE-2022-43935	Nov 21, 2024	Brocade SANnav Information Exposure through Log Files An information exposure through log file vulnerability exists in Brocade SANnav before Brocade SANnav 2.2.2, where Brocade Fabric OS Switch passwords and authorization IDs are printed in the embedded MLS DB file.	Brocade Sannav
CVE-2022-43934	Nov 21, 2024	Brocade SANnav Weak Key Exchange Algorithm Vulnerability Brocade SANnav before Brocade SANnav 2.2.2 supports key exchange algorithms, which are considered weak on ports 24, 6514, 18023, 19094, and 19095.	Brocade Sannav
CVE-2022-43933	Nov 21, 2024	Brocade SANnav Information Exposure Through Log Files An information exposure through log file vulnerability exists in Brocade SANnav before Brocade SANnav 2.2.2, where configuration secrets are logged in supportsave. Supportsave file is generated by an admin user troubleshooting the switch. The Logged information may include usernames and passwords, and secret keys.	Brocade Sannav
CVE-2024-7516	Nov 12, 2024	Brocade Fabric OS <9.2.2 Remote SSH Key Forgery Enables MITM Session Hijacking A vulnerability in Brocade Fabric OS versions before 9.2.2 could allow man-in-the-middle attackers to conduct remote Service Session Hijacking that may arise from the attacker's ability to forge an SSH key while the Brocade Fabric OS Switch is performing various remote operations initiated by a switch admin.	Fabric Operating System
CVE-2024-38813	Sep 17, 2024	VMware vCenter Server Priv Escalation via Malicious Network Packet The vCenter Server contains a privilege escalation vulnerability. A malicious actor with network access to vCenter Server may trigger this vulnerability to escalate privileges to root by sending a specially crafted network packet.	Vmware Center Server Vmware Cloud Foundation
CVE-2024-38812	Sep 17, 2024	VMware vCenter Server DCERPC Heap Overflow RCE The vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution.	Vmware Vcenter Server Vmware Cloud Foundation
CVE-2024-38493	Jul 15, 2024	XSS in CyberArk PAM UI Web Interface A reflected cross-site scripting (XSS) vulnerability exists in the PAM UI web interface. A remote attacker able to convince a PAM user to click on a specially crafted link to the PAM UI web interface could potentially execute arbitrary client-side code in the context of PAM UI.	Symantec Privileged Access Management
CVE-2024-3596	Jul 09, 2024	RADIUS MD5 Response Authenticator Forgery via Chosen-Prefix Collision RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature.	Fabric Operating System Brocade Sannav
CVE-2024-29954	Jun 26, 2024	Brocade Fabric OS Password API Reveals Passwords in Logs ( v9.2.1) A vulnerability in a password management API in Brocade Fabric OS versions before v9.2.1, v9.2.0b, v9.1.1d, and v8.2.3e prints sensitive information in log files. This could allow an authenticated user to view the server passwords for protocols such as scp and sftp. Detail. When the firmwaredownload command is incorrectly entered or points to an erroneous file, the firmware download log captures the failed command, including any password entered in the command line.	Fabric Operating System
CVE-2024-5460	Jun 26, 2024	Auth Remote SNMP Read Hard-Coded Community String in Brocade Fabric OS <9.0.0 A vulnerability in the default configuration of the Simple Network Management Protocol (SNMP) feature of Brocade Fabric OS versions before v9.0.0 could allow an authenticated, remote attacker to read data from an affected device via SNMP. The vulnerability is due to hard-coded, default community string in the configuration file for the SNMP daemon. An attacker could exploit this vulnerability by using the static community string in SNMP version 1 queries to an affected device.	Fabric Operating System
CVE-2024-29953	Jun 26, 2024	Brocade Fabric OS <=9.2.1: Session Password Disclosure A vulnerability in the web interface in Brocade Fabric OS before v9.2.1, v9.2.0b, and v9.1.1d prints encoded session passwords on session storage for Virtual Fabric platforms. This could allow an authenticated user to view other users' session encoded passwords.	Fabric Operating System
CVE-2024-2860	May 08, 2024	Brocade SANnav <2.3.0a Local Auth Bypass (PostgreSQL) The PostgreSQL implementation in Brocade SANnav versions before 2.3.0a is vulnerable to an incorrect local authentication flaw. An attacker accessing the VM where the Brocade SANnav is installed can gain access to sensitive data inside the PostgreSQL database.	Brocade Sannav
CVE-2024-4173	Apr 25, 2024	Brocade SANnav Kafka WAN Interface Unauth DOS Risk A vulnerability in Brocade SANnav exposes Kafka in the wan interface. The vulnerability could allow an unauthenticated attacker to perform various attacks, including DOS against the Brocade SANnav.	Brocade Sannav
CVE-2024-4159	Apr 25, 2024	Brocade SANnav v<2.3.0a Unprotected port 2377/7946 allows Docker sniffing Brocade SANnav before v2.3.0a lacks protection mechanisms on port 2377/TCP and 7946/TCP, which could allow an unauthenticated attacker to sniff the SANnav Docker information.	Brocade Sannav Sannav
CVE-2024-4161	Apr 25, 2024	Brocade SANnav <v2.3.0: Unauthenticated Remote Capture via Cleartext Syslog In Brocade SANnav, before Brocade SANnav v2.3.0, syslog traffic received clear text. This could allow an unauthenticated, remote attacker to capture sensitive information.	Brocade Sannav
CVE-2024-29969	Apr 19, 2024	Brocade SANnav Weak TLS/SSL Ciphers Added in 2.3.0 (v2.2.2->2.3.0) When a Brocade SANnav installation is upgraded from Brocade SANnav v2.2.2 to Brocade SANnav 2.3.0, TLS/SSL weak message authentication code ciphers are added by default for port 18082.	Brocade Sannav
CVE-2024-29968	Apr 19, 2024	Info Disclosure in Brocade SANnav <v2.3.1 DR Mode via Supportsave DB Access An information disclosure vulnerability exists in Brocade SANnav before v2.3.1 and v2.3.0a when Brocade SANnav instances are configured in disaster recovery mode. SQL Table names, column names, and SQL queries are collected in DR standby Supportsave. This could allow authenticated users to access the database structure and its contents.	Brocade Sannav
CVE-2024-29967	Apr 19, 2024	Brocade SANnav <=v2.3 insecure Docker mounts allow privileged read/write In Brocade SANnav before Brocade SANnav v2.31 and v2.3.0a, it was observed that Docker instances inside the appliance have insecure mount points, allowing reading and writing access to sensitive files. The vulnerability could allow a sudo privileged user on the host OS to read and write access to these files.	Brocade Sannav
CVE-2024-29966	Apr 19, 2024	Brocade SANnav OVA Hard-Coded Root Credentials (Unauth Full Access) <v2.3.1 Brocade SANnav OVA before v2.3.1 and v2.3.0a contain hard-coded credentials in the documentation that appear as the appliance's root password. The vulnerability could allow an unauthenticated attacker full access to the Brocade SANnav appliance.	Brocade Sannav
CVE-2024-29965	Apr 19, 2024	Brocade SANnav v2.3.0a: World-Readable Backup Files Permit Local Priv Escal In Brocade SANnav before v2.3.1, and v2.3.0a, it is possible to back up the appliance from the web interface or the command line interface ("SSH"). The resulting backups are world-readable. A local attacker can recover backup files, restore them to a new malicious appliance, and retrieve the passwords of all the switches.	Brocade Sannav
CVE-2024-29964	Apr 19, 2024	Brocade SANnav v<2.3.0a: Improper File Permission Grants Data Exposure Brocade SANnav versions before v2.3.0a do not correctly set permissions on files, including docker files. An unprivileged attacker who gains access to the server can read sensitive information from these files.	Brocade Sannav
CVE-2024-29962	Apr 19, 2024	Brocade SANnav OVA v2.3.0a/v2.3.1: Insecure File Permissions (World-readable) Brocade SANnav OVA before v2.3.1 and v2.3.0a have an insecure file permission setting that makes files world-readable. This could allow a local user without the required privileges to access sensitive information or a Java binary.	Brocade Sannav
CVE-2024-29957	Apr 19, 2024	Brocade SANnav <2.3.1 DR log leaks encryption key When Brocade SANnav before v2.3.1 and v2.3.0a servers are configured in Disaster Recovery mode, the encryption key is stored in the DR log files. This could provide attackers with an additional, less-protected path to acquiring the encryption key.	Brocade Sannav
CVE-2024-29963	Apr 19, 2024	Brocade SANnav OVA v<2.3.1 Hardcoded TLS Keys in Docker Brocade SANnav OVA before v2.3.1, and v2.3.0a, contain hardcoded TLS keys used by Docker. Note: Brocade SANnav doesn't have access to remote Docker registries.	Brocade Sannav
CVE-2024-29961	Apr 19, 2024	Brocade SANnav <=2.3.0a Remote Info Leak via Background Ping to gridgain.com A vulnerability affects Brocade SANnav before v2.3.1 and v2.3.0a. It allows a Brocade SANnav service to send ping commands in the background at regular intervals to gridgain.com to check if updates are available for the Component. This could make an unauthenticated, remote attacker aware of the behavior and launch a supply-chain attack against a Brocade SANnav appliance.	Brocade Sannav
CVE-2024-29960	Apr 19, 2024	Brocade SANnav SSH Key Reuse Before 2.3.1 MITM on SSH In Brocade SANnav server before v2.3.1 and v2.3.0a, the SSH keys inside the OVA image are identical in the VM every time SANnav is installed. Any Brocade SAnnav VM based on the official OVA images is vulnerable to MITM over SSH. An attacker can decrypt and compromise the SSH traffic to the SANnav.	Brocade Sannav
CVE-2024-29959	Apr 19, 2024	Brocade SANnav <2.3.1: Fabric OS passwords leak in support package A vulnerability in Brocade SANnav before v2.3.1 and v2.3.0a prints Brocade Fabric OS switch encrypted passwords in the Brocade SANnav Standby node's support save.	Brocade Sannav
CVE-2024-29958	Apr 19, 2024	Brocade SANnav <v2.3.1/v2.3.0a: Encrypt Key Leak on Console A vulnerability in Brocade SANnav before v2.3.1 and v2.3.0a prints the encryption key in the console when a privileged user executes the script to replace the Brocade SANnav Management Portal standby node. This could provide attackers an additional, less protected path to acquiring the encryption key.	Brocade Sannav
CVE-2024-29956	Apr 18, 2024	Brocade SANnav v2.x Cleartext Password Leak via supportsave Logs A vulnerability in Brocade SANnav before v2.3.1 and v2.3.0a prints the Brocade SANnav password in clear text in supportsave logs when a user schedules a switch Supportsave from Brocade SANnav.	Brocade Sannav
CVE-2024-29952	Apr 17, 2024	Brocade SANnav <=2.3.0a Auth/SSL KeyStore Passwords Leak in Logs A vulnerability in Brocade SANnav before v2.3.1 and v2.3.0a could allow an authenticated user to print the Auth, Priv, and SSL key store passwords in unencrypted logs by manipulating command variables.	Brocade Sannav
CVE-2024-29955	Apr 17, 2024	Brocade SANnav < 2.3.1 Log Key Exposure in Postgres Startups A vulnerability in Brocade SANnav before v2.3.1 and v2.3.0a could allow a privileged user to print the SANnav encrypted key in PostgreSQL startup logs. This could provide attackers with an additional, less-protected path to acquiring the encryption key.	Brocade Sannav