ExtremeXOS Debug-Mode Privilege Escalation via Weak PRNG

Description

ExtremeXOS (EXOS) uses a challenge-response mechanism to authorize access to the privileged debug-mode function. The challenge value is generated using an insufficiently random source, which under certain conditions may allow an attacker to predict the expected response and activate debug-mode without authorization. Depending on device configuration and version, this may enable escalation to root-level access and persistent modification of the device software stack. Exploitation requires either a valid low-privilege account on the device (remote scenario) or physical serial console access (local scenario). This vulnerability is distinct from CVE-2017-14329, which addressed a different issue involving Python script privileges. Extreme would like to thank Hadrien Barral (Université Gustave Eiffel) and Georges-Axel Jaloyan (French Ministry of the Interior) for responsible disclosure of their findings.

Scores

EPSS (exploitation in 30 days)

0.38% · top 68% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.7.

Weakness

• CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) (opens in a new tab)All about CWE-338 and its CVEs

Affected products

• Extreme Networks · Switch Engine (EXOS)

  • affected < 31.7.4
  • affected 32.0.0 – < 32.7.4.15
  • affected 33.0.0 – < 33.1.100
  • affected 33.2.0 – < 33.7.1

What to do

Solution: Extreme Networks has released fixed versions of Switch Engine (EXOS) that address this vulnerability. Customers should upgrade to one of the following releases or later: 31.7.4, 32.7.4.15, 33.1.100, or 33.7.1.

Workaround: Where immediate upgrade is not feasible, customers should: (1) restrict CLI access to trusted administrators only; (2) enforce strong authentication and rotate any default credentials; (3) restrict physical access to serial console ports; and (4) monitor device logs for unexpected debug-mode activation attempts.

References (1)

• Extreme Networks Product Security (opens in a new tab)vendor-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-8169](https://trackcve.app/badge/CVE-2026-8169.svg)](https://trackcve.app/cve/CVE-2026-8169)

Record last updated 20 Jul 2026, 19:20 UTC.