Skip to content
OpenAdvisories

Vendor

Extreme Networks

11 known vulnerabilities.

Products

Switch Engine (EXOS) 3 ExtremeCloud Universal ZTNA 1 Extreme Platform ONE 1 IQ Engine 1 Aerohive HiveOS 1 ExtremeCloud IQ - Site Engine 1 ExtremeGuest Essentials 1 Fabric Engine (VOSS) 1 ExtremeControl 1 HiveOS 0 IQ Engine < 10.6r5 0 IQ Engine < 10.6r2 0 ExtremeXOS 0 ExtremeXOS < 22.7.5.1 0 ExtremeXOS < 31.3.100 0 ExtremeXOS < 31.7.2.28 0 ExtremeXOS < 32.5.1.5 0 Extreme Management Center 0 HiveManager Classic On-Premises < XIQ 0
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 8.3
    CVE-2026-105440 Public exploit

    Missing authorization in the JSON-RPC web services interface of Extreme Networks Switch Engine (EXOS) allows an authent…

    Extreme Networks Switch Engine (EXOS)
  • High 8.8
    CVE-2023-46273

    Bonjour Gateway in Extreme Networks IQ Engine before 10.6r1a, and through 10.6r4 before 10.6r5, has an ah_bgd buffer ov…

    Extreme Networks IQ Engine
  • High 8.7
    CVE-2026-8170

    ExtremeXOS Privilege Escalation via Symlink Following in File Utilities

    The mv, cp, and rm file utilities exposed within the ExtremeXOS (EXOS) shell environment fail to safely canonicalize paths and follow symbolic links outside of the intended privilege boundary. An attacker with low-privilege CLI access can create a symbolic li…

    Extreme Networks Switch Engine (EXOS)
  • High 8.7
    CVE-2026-8169

    ExtremeXOS Debug-Mode Privilege Escalation via Weak PRNG

    ExtremeXOS (EXOS) uses a challenge-response mechanism to authorize access to the privileged debug-mode function. The challenge value is generated using an insufficiently random source, which under certain conditions may allow an attacker to predict the expect…

    Extreme Networks Switch Engine (EXOS)
  • High 7.5
    CVE-2020-36907

    Extreme Networks Aerohive HiveOS <=11.x 11.x Unauthenticated Remote Denial of Service

    Aerohive HiveOS contains a denial of service vulnerability in the NetConfig UI that allows unauthenticated attackers to render the web interface unusable. Attackers can send a crafted HTTP request to the action.php5 script with specific parameters to trigger …

    Extreme Networks Aerohive HiveOS
  • High 8.4
    CVE-2025-11192

    Fabric Engine (VOSS) AutoSense Authentication Bypass

    A vulnerability in Extreme Networks’ Fabric Engine (VOSS) before 9.3 was discovered. When SD-WAN AutoSense is enabled on a port, it may automatically configure fabric connectivity without validating ISIS authentication settings. The SD-WAN AutoSense implement…

    Extreme Networks Fabric Engine (VOSS)
  • High 7.6
    CVE-2025-8679

    ExtremeGuest Essentials Captive Portal Unauthenticated Brute Force

    In ExtremeGuest Essentials before 25.5.0, captive-portal may permit unauthorized access via manual brute-force procedure. Under certain ExtremeGuest Essentials captive-portal SSID configurations, repeated manual login attempts may allow an unauthenticated dev…

    Extreme Networks ExtremeGuest Essentials