https://vulnogram.org/ Most recent CVEs assigned by Extreme Networks, Inc. (extremenetworks). https://vulnogram.org/seaview/icons/extremenetworks.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-8170 https://vulnogram.org/CVE-2026-8170 The mv, cp, and rm file utilities exposed within the ExtremeXOS (EXOS) shell environment fail to safely canonicalize paths and follow symbolic links outside of the intended privilege boundary. An attacker with low-privilege CLI access can create a sy… High Mon, 20 Jul 2026 17:34:10 GMT https://vulnogram.org/CVE-2026-8169 https://vulnogram.org/CVE-2026-8169 ExtremeXOS (EXOS) uses a challenge-response mechanism to authorize access to the privileged debug-mode function. The challenge value is generated using an insufficiently random source, which under certain conditions may allow an attacker to predict t… High Mon, 20 Jul 2026 17:33:05 GMT https://vulnogram.org/CVE-2026-9831 https://vulnogram.org/CVE-2026-9831 A race condition in the shared Extreme Platform ONE IAM Gateway API-key authentication path could, under specific high-concurrency traffic conditions, intermittently allow requests authenticated with an Extreme Platform ONE /IAM-issued API key to rec… Medium Fri, 29 May 2026 21:19:17 GMT https://vulnogram.org/CVE-2026-0689 https://vulnogram.org/CVE-2026-0689 In ExtremeCloud IQ – Site Engine (XIQ‑SE) before 26.2.10, a vulnerability in the NAC administration interface allows an authenticated NAC administrator to retrieve masked sensitive parameters from HTTP responses. Although credentials appear redacted… Medium Mon, 02 Mar 2026 15:16:44 GMT https://vulnogram.org/CVE-2025-11192 https://vulnogram.org/CVE-2025-11192 A vulnerability in Extreme Networks’ Fabric Engine (VOSS) before 9.3 was discovered. When SD-WAN AutoSense is enabled on a port, it may automatically configure fabric connectivity without validating ISIS authentication settings. The SD-WAN AutoSense… High Tue, 07 Oct 2025 19:07:45 GMT https://vulnogram.org/CVE-2025-8679 https://vulnogram.org/CVE-2025-8679 In ExtremeGuest Essentials before 25.5.0, captive-portal may permit unauthorized access via manual brute-force procedure. Under certain ExtremeGuest Essentials captive-portal SSID configurations, repeated manual login attempts may allow an unauthenti… High Wed, 01 Oct 2025 17:19:16 GMT https://vulnogram.org/CVE-2025-6235 https://vulnogram.org/CVE-2025-6235 In ExtremeControl before 25.5.12, a cross-site scripting (XSS) vulnerability was discovered in a login interface of the affected application. The issue stems from improper handling of user-supplied input within HTML attributes, allowing an attacker t… Medium Network Exploitable Mon, 21 Jul 2025 14:07:41 GMT https://vulnogram.org/CVE-2025-6083 https://vulnogram.org/CVE-2025-6083 In ExtremeCloud Universal ZTNA, a syntax error in the 'searchKeyword' condition caused queries to bypass the owner_id filter. This issue may allow users to search data across the entire table instead of being restricted to their specific owner_id. Medium Fri, 13 Jun 2025 21:06:34 GMT