# CVE-2026-105440: Extreme Networks Switch Engine authorization bypass in JSON-RPC interface

Source: https://junglewise.ai/threats/cve-2026-105440-missing-authorization-in-the-json-rpc-web-services-interface-of  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-11  
License: CC BY 4.0 with a link back

CVE-2026-105440 · Severity: medium · CVSS 6.5 · Published 2026-11-11

Extreme Networks Switch Engine (EXOS) is a network operating system for switches. A flaw in its JSON-RPC web services interface fails to enforce the same access restrictions as the command-line interface, allowing a read-only user who can reach the management port to retrieve sensitive information such as device configuration and password hashes. An attacker with these hashes could crack weak passwords offline to gain administrative access to the device.

Vendors: [Extreme Networks](https://junglewise.ai/threats/vendors/extreme-networks).

## Quick answers

**Is CVE-2026-105440 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105440 being exploited in the wild.

**How severe is CVE-2026-105440?** Medium severity, with a CVSS score of 6.5, published 11 November 2026.

**Which products and versions are affected?** Extreme Networks Switch Engine (EXOS) Before 32.7.4.15-patch1-11, 33.1.100.133-patch1-9, 33.7.1-patch1-11, or 34.1.1.

**Is there a fix for CVE-2026-105440?** Yes: fixed in Switch Engine (EXOS) 32.7.4.15-patch1-11, 33.1.100.133-patch1-9, 33.7.1-patch1-11, or 34.1.1 or later. Until then: Restrict management interface access to trusted networks, disable the JSON-RPC web services interface where not required, and enforce strong, unique passwords on all local accounts. After upgrading, rotate all local account passwords, especially administrative accounts.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-11-11"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-105440 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-105440?** Check whether you run Extreme Networks Switch Engine (EXOS) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Switch Engine (EXOS) 32.7.4.15-patch1-11, 33.1.100.133-patch1-9, 33.7.1-patch1-11, or 34.1.1 or later

Restrict management interface access to trusted networks, disable the JSON-RPC web services interface where not required, and enforce strong, unique passwords on all local accounts. After upgrading, rotate all local account passwords, especially administrative accounts.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-11-11"}]

## Technical details

The JSON-RPC web services interface in Switch Engine does not properly validate user authorization when executing show commands, bypassing restrictions that the CLI enforces for read-only accounts. An authenticated, low-privilege user with network access to the management interface can execute restricted show commands to extract device configuration and local account password hashes. Configuration, enable, and debug commands are correctly blocked; the vulnerability requires prior authentication and network access to the management interface.

## Affected products

- Extreme Networks Switch Engine (EXOS) Before 32.7.4.15-patch1-11, 33.1.100.133-patch1-9, 33.7.1-patch1-11, or 34.1.1

## References

- [https://extreme-networks.my.site.com/ExtrArticleDetail?an=000140004](https://extreme-networks.my.site.com/ExtrArticleDetail?an=000140004)