The U.S. Cybersecurity & Infrastructure Security Agency (CISA) is warning of Broadcom Brocade Fabric OS, Commvault web servers, and Qualitia Active! Mail clients vulnerabilities that are actively exploited in attacks.

The flaws were added yesterday to CISA’s ‘Known Exploited Vulnerabilities’ (KEV) catalog, with the Broadcom Brocade Fabric OS and Commvault flaws not previously tagged as exploited.

Broadcom Brocade Fabric OS is a specialized operating system that runs on the company’s Brocade Fibre Channel switches to manage and optimize storage area networks (SAN).

Earlier this month, Broadcom disclosed an arbitrary code execution flaw impacting Fabric OS versions 9.1.0 through 9.1.1d6, tracked under CVE-2025-1976.

While the flaw requires admin privileges to exploit, Broadcom says it has been actively exploited in attacks.

“This vulnerability can allow the user to execute any existing Fabric OS command or can also be used to modify the Fabric OS itself, including adding their own subroutines,” reads Broadcom’s bulletin.

“Even though achieving this exploit first requires valid access to a role with admin privileges, this vulnerability has been actively exploited in the field.”

CVE-2025-1976 was addressed with the release of Brocade Fabric OS 9.1.1d7. The latest branch, 9.2.0, is not impacted by this vulnerability.

The Commvault flaw, tracked under CVE-2025-3928, is an unspecified security problem that authenticated attackers can exploit remotely to plant webshells on target servers.

Commvault web servers are user-facing and API components of a backup system used by enterprises to protect and restore critical data.

Despite the requirements for authentication and exposure of the environment to the internet, the flaw is under active exploitation in the wild.

CVE-2025-3928 was fixed in versions 11.36.46, 11.32.89, 11.28.141, and 11.20.217 for Windows and Linux platforms.

The third flaw CISA added to KEV is CVE-2025-42599, a stack-based buffer overflow problem impacting all versions of Active! up to and including ‘BuildInfo: 6.60.05008561’ on all OS platforms.

Active! mail is a web-based email client widely used by government, financial, and IT service organizations in Japan.

The flaw was flagged as actively exploited last week by Japan’s CERT, while SMB providers and ISPs in the country also announced service outages caused by related exploitation activity.

Qualitia addressed the problem with the release of Active! Mail 6 BuildInfo: 6.60.06008562.

CISA has given impacted organizations until May 17, 2025, to apply fixes or available mitigations for CVE-2025-3928 and May 19, 2025, for the other two flaws.

On Wednesday, CISA warned of heightened breach risks after the compromise of legacy Oracle Cloud servers earlier this year and highlighted the significant threat to enterprise networks.

CISA said, “the nature of the reported activity presents potential risk to organizations and individuals, particularly where credential material may be exposed, reused across separate, unaffiliated systems, or embedded (i.e., hardcoded into scripts, applications, infrastructure templates, or automation tools),” even though “the scope and impact remains unconfirmed.”

“When credential material is embedded, it is difficult to discover and can enable long-term unauthorized access if exposed. The compromise of credential material, including usernames, emails, passwords, authentication tokens, and encryption keys, can pose significant risk to enterprise environments,” it added.

The U.S. cybersecurity agency also released guidance to mitigate the risks linked to the resulting credential leak, urging network defenders to reset affected users’ passwords, replace hardcoded or embedded credentials with secure authentication methods, enforce phishing-resistant multi-factor authentication (MFA) wherever possible, and monitor authentication logs for suspicious activity.

This warning comes after Oracle confirmed in email notifications sent to customers that a threat actor leaked credentials stolen from what the company described as “two obsolete servers.”

However, Oracle added that its Oracle Cloud servers were not compromised, and the incident didn’t impact its cloud services or customer data.

​Oracle also privately acknowledged in calls with some of its clients that attackers stole old client credentials after breaching a “legacy environment” last used in 2017. However, the hacker behind the breach posted newer records from 2025 on BreachForums and shared data with BleepingComputer from the end of 2024.

BleepingComputer ​​​​​has separately confirmed with multiple Oracle customers that leaked data samples (including associated LDAP display names, email addresses, given names, and other identifying information) received from the threat actor were valid.

In late March, cybersecurity firm CybelAngel also revealed that Oracle told customers that an attacker deployed a web shell and additional malware on some of its Gen 1 (also known as Oracle Cloud Classic) servers as early as January 2025.

Until the breach was detected in late February, the attacker allegedly stole data from the Oracle Identity Manager (IDM) database, which included hashed passwords, usernames, and user emails.

Last month, BleepingComputer first reported that Oracle also issued private customer notifications regarding another January breach at Oracle Health (a SaaS company previously known as Cerner) that impacted patient data at multiple U.S. healthcare organizations and hospitals.