Extreme Networks vulnerabilities
We track 4 vulnerabilities in Extreme Networks products across 3 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on July 20, 2026.
Latest Extreme Networks vulnerabilities
- 8.7 High severity
Switch Engine (EXOS): Improper Link Resolution Before File Access
The mv, cp, and rm file utilities exposed within the ExtremeXOS (EXOS) shell environment fail to safely canonicalize paths and follow symbolic links outside of the intended privilege boundary. An attacker with low-privilege CLI access can create a symbolic lin
- 8.7 High severity
Switch Engine (EXOS): Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
ExtremeXOS (EXOS) uses a challenge-response mechanism to authorize access to the privileged debug-mode function. The challenge value is generated using an insufficiently random source, which under certain conditions may allow an attacker to predict the expecte
- 8.6 High severity
Fabric Engine (VOSS): Improper Authentication
A vulnerability in Extreme Networks’ Fabric Engine (VOSS) before 9.3 was discovered. When SD-WAN AutoSense is enabled on a port, it may automatically configure fabric connectivity without validating ISIS authentication settings. The SD-WAN AutoSense implementa
- 9.8 Critical severity
ExtremeGuest Essentials: Improper Restriction of Excessive Authentication Attempts
In ExtremeGuest Essentials before 25.5.0, captive-portal may permit unauthorized access via manual brute-force procedure. Under certain ExtremeGuest Essentials captive-portal SSID configurations, repeated manual login attempts may allow an unauthenticated devi