CVE-2026-8169: Extreme Networks ExtremeXOS auth bypass in debug-mode

CVE-2026-8169 · Severity: info · CVSS 8.7 · Published 2026-07-20

ExtremeXOS (EXOS) is the operating system used in Extreme Networks enterprise switches to manage network traffic and security. A vulnerability in the system's debug mode allows an attacker with low-level access to bypass security checks and gain full administrative control. This could lead to unauthorized monitoring of network traffic, permanent modification of the device software, or a complete takeover of the network infrastructure.

Vendors: Extreme Networks.

Quick answers

Is CVE-2026-8169 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-8169 being exploited in the wild.
How severe is CVE-2026-8169?
Informational severity, with a CVSS score of 8.7, published 20 July 2026.
Which products and versions are affected?
Extreme Networks Switch Engine < 31.7.4, 32.0.0 < 32.7.4.15, 33.0.0 < 33.1.100, 33.2.0 < 33.7.1.
Is there a fix for CVE-2026-8169?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-8169 attacked?
It is attacked over the network or with local access, in an operating system.
Am I affected by CVE-2026-8169?
Check whether you run Extreme Networks Switch Engine at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

ExtremeXOS (EXOS) contains a vulnerability (CWE-338) where the challenge-response mechanism for accessing privileged debug-mode functions uses an insufficiently random source for challenge generation. This predictability allows an attacker to calculate the expected response and bypass authentication for the debug interface. Exploitation requires either a valid low-privilege account for remote network access or physical access to the serial console. Successful exploitation can lead to root-level privilege escalation and the ability to persistently modify the device's software stack. The issue is addressed in versions 31.7.4, 32.7.4.15, 33.1.100, and 33.7.1.

Affected products

  • Extreme Networks Switch Engine (EXOS) < 31.7.4, 32.0.0 < 32.7.4.15, 33.0.0 < 33.1.100, 33.2.0 < 33.7.1

Timeline

  • 2026-07-20: disclosed
  • 2026-07-20: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.