CVE-2026-8170ExtremeXOS Privilege Escalation via Symlink Following in File Utilities
Updated under an hour ago ()
Does this affect you?
It affects Extreme Networks Switch Engine (EXOS). Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
The mv, cp, and rm file utilities exposed within the ExtremeXOS (EXOS) shell environment fail to safely canonicalize paths and follow symbolic links outside of the intended privilege boundary. An attacker with low-privilege CLI access can create a symbolic link that references a privileged filesystem location and then invoke the affected utilities to read, modify, or replace security-critical files outside of their authorized scope. Under certain conditions, this may enable escalation to root-level access and persistent modification of the device software stack. Exploitation is possible remotely by an attacker holding a low-privilege account, or locally via the serial console. Extreme would like to thank Hadrien Barral (Université Gustave Eiffel) and Georges-Axel Jaloyan (French Ministry of the Interior) for responsible disclosure of their findings.
- CVSS
- 8.7 HIGH (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Weakness (CWE)
- CWE-59
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- ExtremeNetworks
- NVD analysis
- Awaiting Analysis
- Record last updated
- Jul 20, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Extreme Networks Switch Engine (EXOS) extreme_networks:switch_engine_exos (from the name) | before 31.7.4; from 32.0.0 before 32.7.4.15; from 33.0.0 before 33.1.100; from 33.2.0 before 33.7.1 | CNA record |
References
- https://www.extremenetworks.com/support/policies/product-security
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.