Read the docs
TI-2026-60092 Aliases CVE-2026-88263GHSA-jxpm-cmg2-h9hw

Missing authentication in XikeStor SKS8310-8X

Priority MEDIUM 44CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

XikeStor Layer3 switches miss authentication for downloading configuration data. Unauthenticated attacker may retrieve the configuration data containing network configurations and passwords to operate the affected product improperly or to exploit the affected product as a jump host.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00585 48th percentileScored 2026-11-07
Fix Fixed SKS8310-8X (XikeStor): V1.04.B09SKS8300-8T (XikeStor): V1.04.B09+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
XikeStorSKS8310-8Xbefore V1.04.B09V1.04.B09Patch availableCNA
XikeStorSKS8300-8Tbefore V1.04.B09V1.04.B09Patch availableCNA
XikeStorSKS8300-12E2T2Xbefore V1.04.B09V1.04.B09Patch availableCNA
  • SKS8310-8X VendorXikeStor Affected before V1.04.B09 Fixed in V1.04.B09 Patch available CNA
  • SKS8300-8T VendorXikeStor Affected before V1.04.B09 Fixed in V1.04.B09 Patch available CNA
  • SKS8300-12E2T2X VendorXikeStor Affected before V1.04.B09 Fixed in V1.04.B09 Patch available CNA

Remediation

  • Fix · CNA SKS8310-8X (XikeStor) Fixed in V1.04.B09
  • Fix · CNA SKS8300-8T (XikeStor) Fixed in V1.04.B09
  • Fix · CNA SKS8300-12E2T2X (XikeStor) Fixed in V1.04.B09

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-88263
  2. 2026-10-03 Alias added: GHSA-jxpm-cmg2-h9hw

References

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences