CVE-2026-8169 ExtremeXOS Debug-Mode Privilege Escalation via Weak PRNG
Attackers with low-privilege access or physical console access can predict debug-mode challenges to gain root privileges and modify the switch software stack.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-8169?
CVE-2026-8169 is a high-severity vulnerability in Extreme Networks Switch Engine (EXOS), published on 20 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
ExtremeXOS (EXOS) uses a challenge-response mechanism to authorize access to the privileged debug-mode function. The challenge value is generated using an insufficiently random source, which under certain conditions may allow an attacker to predict the expected response and activate debug-mode without authorization. Depending on device configuration and version, this may enable escalation to root-level access and persistent modification of the device software stack. Exploitation requires either a valid low-privilege account on the device (remote scenario) or physical serial console access (local scenario). This vulnerability is distinct from CVE-2017-14329, which addressed a different issue involving Python script privileges.
Extreme would like to thank Hadrien Barral (Université Gustave Eiffel) and Georges-Axel Jaloyan (French Ministry of the Interior) for responsible disclosure of their findings.
Weakness: CWE-338
Which versions are affected by CVE-2026-8169?
How do I fix CVE-2026-8169?
No fix has been published for CVE-2026-8169 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-8169 being exploited?
There is no known exploitation of CVE-2026-8169 in the wild and no public exploit code.
Sources
Also known as GHSA-mxjh-p6gq-89p9.