Read the docs
TI-2026-07192 Aliases CVE-2026-8169GHSA-mxjh-p6gq-89p9

ExtremeXOS Debug-Mode Privilege Escalation via Weak PRNG

Priority MEDIUM 40CWE-338Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

ExtremeXOS (EXOS) uses a challenge-response mechanism to authorize access to the privileged debug-mode function. The challenge value is generated using an insufficiently random source, which under certain conditions may allow an attacker to predict the expected response and activate debug-mode without authorization. Depending on device configuration and version, this may enable escalation to root-level access and persistent modification of the device software stack. Exploitation requires either a valid low-privilege account on the device (remote scenario) or physical serial console access (local scenario). This vulnerability is distinct from CVE-2017-14329, which addressed a different issue involving Python script privileges. Extreme would like to thank Hadrien Barral (Université Gustave Eiffel) and Georges-Axel Jaloyan (French Ministry of the Interior) for responsible disclosure of their findings.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00382 32nd percentileScored 2026-11-07
Fix Fixed Switch Engine (EXOS) (Extreme Networks): 31.7.4, 32.7.4.15, 33.1.100 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Extreme NetworksSwitch Engine (EXOS)before 31.7.4; 32.0.0 to before 32.7.4.15; 33.0.0 to before 33.1.100; 33.2.0 to before 33.7.131.7.4, 32.7.4.15, 33.1.100, 33.7.1Patch availableCNA
  • Switch Engine (EXOS) VendorExtreme Networks Affected before 31.7.4; 32.0.0 to before 32.7.4.15; 33.0.0 to before 33.1.100; 33.2.0 to before 33.7.1 Fixed in 31.7.4, 32.7.4.15, 33.1.100, 33.7.1 Patch available CNA

Remediation

  • Fix · CNA Switch Engine (EXOS) (Extreme Networks) Fixed in 31.7.4, 32.7.4.15, 33.1.100, 33.7.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Extreme Networks Switch Engine (EXOS) 31.7.4, 32.7.4.15 and 2 more versions

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2026-07193 ExtremeXOS Privilege Escalation via Symlink Following in File UtilitiesPriority MEDIUM 40
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-8169
  2. 2026-10-03 Alias added: GHSA-mxjh-p6gq-89p9

References

Advisory 1

  • TI-2020-19042 Extreme Networks Aerohive HiveOS <=11.x 11.x Unauthenticated Remote Denial of Service CVSS 4.0HIGH 8.7
  • TI-2020-13364 Extreme Networks EXOS before v.22.7 and before v.30.2 was discovered to contain an issue… CVSS 3.1HIGH 8.0
  • TI-2020-12704 The NetConfig UI administrative interface in Extreme Networks ExtremeWireless Aerohive… CVSS 3.1CRITICAL 9.8
  • TI-2023-17891 IQ Engine before 10.6r2 on Extreme Network AP devices has a Buffer Overflow. CVSS 3.1CRITICAL 9.8
  • TI-2023-17890 IQ Engine before 10.6r1 on Extreme Network AP devices has a Buffer Overflow in the… CVSS 3.1CRITICAL 9.8
  • TI-2024-25570 In Extreme Networks XIQ-SE before 24.2.11, due to a missing access control check, a path… CVSS 3.1CRITICAL 9.8
See all 34 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences