Vendor
Extreme Networks
11 known vulnerabilities.
Extreme Networks at a glance
- Last 12 months
- 7
- Critical · all time
- 0
- Exploited · all time
- 0
- Public exploit · all time
- 1
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 1 | 0 |
| Oct 2026 | 0 | 0 |
| Sep 2026 | 1 | 0 |
| Aug 2026 | 0 | 0 |
| Jul 2026 | 2 | 0 |
| Jun 2026 | 0 | 0 |
| May 2026 | 1 | 0 |
| Apr 2026 | 0 | 0 |
| Mar 2026 | 1 | 0 |
| Feb 2026 | 0 | 0 |
| Jan 2026 | 1 | 0 |
| Dec 2025 | 0 | 0 |
| Nov 2025 | 0 | 0 |
| Oct 2025 | 2 | 0 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 0 | 0 |
| Jul 2025 | 1 | 0 |
| Jun 2025 | 1 | 0 |
| May 2025 | 0 | 0 |
| Apr 2025 | 0 | 0 |
| Mar 2025 | 0 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 0 | 0 |
Products
Latest advisories
-
Medium max 8.3WID-SEC-2026-4537 1 CVE
Extreme Networks ExtremeXOS: Schwachstelle ermöglicht Offenlegung von Informationen
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Extreme Networks ExtremeXOS ausnutzen, um Sicherheitsvorkehrungen zu umgehen und Informationen offenzulegen.
-
High max 9.8
Extreme Networks IQ Engine: Mehrere Schwachstellen
Ein entfernter anonymer Angreifer kann mehrere Schwachstellen in Extreme Networks IQ Engine ausnutzen, um Informationen offenzulegen oder beliebigen Code auszuführen.
first Dec 5, 2023 -
High max 8.7
Extreme Networks ExtremeXOS: Mehrere Schwachstellen
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Extreme Networks ExtremeXOS ausnutzen, um Administratorrechte zu erlangen, Sicherheitsmaßnahmen zu umgehen oder Daten zu manipulieren.
first Jul 19, 2026 -
Medium max 7.0
OpenSSH: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen
Ein lokaler Angreifer kann eine Schwachstelle in OpenSSH ausnutzen, um Sicherheitsvorkehrungen zu umgehen.
first Dec 26, 2023 -
Medium max 7.5
Apache Commons und Apache Tomcat: Schwachstelle ermöglicht Denial of Service
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Apache Commons und Apache Tomcat ausnutzen, um einen Denial of Service Angriff durchzuführen.
first Feb 20, 2023
11 results · Feed
-
High 8.3CVE-2026-105440 Public exploit
Missing authorization in the JSON-RPC web services interface of Extreme Networks Switch Engine (EXOS) allows an authent…
-
High 8.8
Bonjour Gateway in Extreme Networks IQ Engine before 10.6r1a, and through 10.6r4 before 10.6r5, has an ah_bgd buffer ov…
-
High 8.7
ExtremeXOS Privilege Escalation via Symlink Following in File Utilities
The mv, cp, and rm file utilities exposed within the ExtremeXOS (EXOS) shell environment fail to safely canonicalize paths and follow symbolic links outside of the intended privilege boundary. An attacker with low-privilege CLI access can create a symbolic li…
-
High 8.7
ExtremeXOS Debug-Mode Privilege Escalation via Weak PRNG
ExtremeXOS (EXOS) uses a challenge-response mechanism to authorize access to the privileged debug-mode function. The challenge value is generated using an insufficiently random source, which under certain conditions may allow an attacker to predict the expect…
-
Medium 6.3
ExtremeCloud IQ Cross Tenant Data Exposure via Extreme Platform One Authentication Race Condition
A race condition in the shared Extreme Platform ONE IAM Gateway API-key authentication path could, under specific high-concurrency traffic conditions, intermittently allow requests authenticated with an Extreme Platform ONE /IAM-issued API key to receive resp…
-
Medium 6.0
XIQ‑SE NAC Admin Credential Exposure via HTTP Response
In ExtremeCloud IQ – Site Engine (XIQ‑SE) before 26.2.10, a vulnerability in the NAC administration interface allows an authenticated NAC administrator to retrieve masked sensitive parameters from HTTP responses. Although credentials appear redacted in the us…
-
High 7.5
Extreme Networks Aerohive HiveOS <=11.x 11.x Unauthenticated Remote Denial of Service
Aerohive HiveOS contains a denial of service vulnerability in the NetConfig UI that allows unauthenticated attackers to render the web interface unusable. Attackers can send a crafted HTTP request to the action.php5 script with specific parameters to trigger …
-
High 8.4
Fabric Engine (VOSS) AutoSense Authentication Bypass
A vulnerability in Extreme Networks’ Fabric Engine (VOSS) before 9.3 was discovered. When SD-WAN AutoSense is enabled on a port, it may automatically configure fabric connectivity without validating ISIS authentication settings. The SD-WAN AutoSense implement…
-
High 7.6
ExtremeGuest Essentials Captive Portal Unauthenticated Brute Force
In ExtremeGuest Essentials before 25.5.0, captive-portal may permit unauthorized access via manual brute-force procedure. Under certain ExtremeGuest Essentials captive-portal SSID configurations, repeated manual login attempts may allow an unauthenticated dev…
-
Medium 5.3
ExtremeControl (NAC) 'onmouseover' XSS
In ExtremeControl before 25.5.12, a cross-site scripting (XSS) vulnerability was discovered in a login interface of the affected application. The issue stems from improper handling of user-supplied input within HTML attributes, allowing an attacker to inject …
-
Medium 5.2
ExtremeCloud Universal ZTNA Improper Authorization
In ExtremeCloud Universal ZTNA, a syntax error in the 'searchKeyword' condition caused queries to bypass the owner_id filter. This issue may allow users to search data across the entire table instead of being restricted to their specific owner_id.