Extreme Networks

CVE-2026-105440: Missing authorization in the JSON-RPC web services interface of Extreme Networks Switch Engine (EXOS) allows an authenticated, low-privileged (read-only) user t

CVE-2026-105440 Nov 11, 2026 Source: Vendor

Missing authorization in the JSON-RPC web services interface
of Extreme Networks Switch Engine (EXOS) allows an authenticated,
low-privileged (read-only) user to execute CLI show commands that are
restricted to that role through the command line interface. Successful
exploitation results in disclosure of sensitive information, including the
device configuration and the password hashes of local accounts. Configuration,
enable, and debug commands are not affected. Disclosed password hashes can be

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-105440

Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

1 line

Showing 1–1 of 1

CVE-2026-105440 BR2026-0000-047230 unclaimed

Credited as Toàn Lê