Is CVE-2026-9831 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9831 being exploited in the wild.

How severe is CVE-2026-9831?

Medium severity, with a CVSS score of 6.3, published 29 May 2026.

Which products and versions are affected?

Extreme Networks Extreme Platform ONE IAM Gateway; Extreme Networks ExtremeCloud IQ (XIQ).

Is there a fix for CVE-2026-9831?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-9831 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-9831?

Check whether you run Extreme Networks Extreme Platform ONE IAM Gateway or Extreme Networks ExtremeCloud IQ. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9831: Extreme Networks Extreme Platform ONE race condition in IAM Gateway

CVE-2026-9831 · Severity: medium · CVSS 6.3 · Published 2026-05-29

A security flaw in the Extreme Networks cloud management platform could allow one customer to accidentally view data belonging to another customer. This issue occurs intermittently during periods of very high system traffic when using specific API key authentication. While it does not allow an attacker to choose whose data they see, it poses a risk to data privacy and multi-tenant isolation.

Vendors: Extreme Networks.

Quick answers

Is CVE-2026-9831 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9831 being exploited in the wild.
How severe is CVE-2026-9831?: Medium severity, with a CVSS score of 6.3, published 29 May 2026.
Which products and versions are affected?: Extreme Networks Extreme Platform ONE IAM Gateway; Extreme Networks ExtremeCloud IQ (XIQ).
Is there a fix for CVE-2026-9831?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-9831 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-9831?: Check whether you run Extreme Networks Extreme Platform ONE IAM Gateway or Extreme Networks ExtremeCloud IQ. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A race condition (CWE-362) exists in the shared Extreme Platform ONE IAM Gateway API-key authentication path. Under conditions of high-concurrency traffic, the gateway may improperly synchronize shared resources, leading to the exposure of a data element to the wrong session (CWE-488). This allows a request authenticated with a valid IAM-issued API key to intermittently receive response data intended for a different tenant. The vulnerability specifically affects the XIQ/XAPI and Common Services API paths; notably, XIQ-native tokens and standard OAuth/Bearer JWT authentication methods are not impacted. Exploitation requires the attacker to have a valid API key and for the system to be under specific high-load conditions.

Affected products

Extreme Networks Extreme Platform ONE IAM Gateway
Extreme Networks ExtremeCloud IQ (XIQ)

Timeline

2026-05-29: disclosed
2026-05-29: advisory

References

https://community.extremenetworks.com/t5/security-advisories-formerly/sa-2026-048-extremecloud-iq-cross-tenant-data-exposure-via/ba-p/121851

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.