Challenge-response Authorization Flaw in Extreme Networks' ExtremeXOS
CVE-2026-8169

8.7HIGH

Key Information:

Vendor

Extreme Networks

Status
Switch Engine (exos)
Vendor
CVE Published:
20 July 2026

What is CVE-2026-8169?

ExtremeXOS contains a vulnerability in its challenge-response mechanism, where the challenge value is generated from an insufficiently random source. This weakness can allow attackers to predict expected responses under certain circumstances, granting unauthorized access to the debug-mode function. If exploited, this could lead to the escalation of privileges to root-level access and allow persistent modifications to the device's software stack. Exploitation demands either a valid low-privilege account remotely or physical access through the serial console locally.

Affected Version(s)

Switch Engine (EXOS) Switch Engine 0 < 31.7.4

Switch Engine (EXOS) Switch Engine 32.0.0 < 32.7.4.15

Switch Engine (EXOS) Switch Engine 33.0.0 < 33.1.100

References

https://www.extremenetworks.com/support/policies/product-...
vendor-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Extreme would like to thank Hadrien Barral (Université Gustave Eiffel) and Georges-Axel Jaloyan (French Ministry of the Interior) for responsible disclosure of their findings.
.