CVE-2026-0689

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0689", "assignerOrgId": "1c053176-eef3-4d6a-ae0b-24728c86587b", "state": "PUBLISHED", "assignerShortName": "ExtremeNetworks", "dateReserved": "2026-01-07T20:12:47.064Z", "datePublished": "2026-03-02T15:16:44.054Z", "dateUpdated": "2026-03-02T19:17:37.551Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "ExtremeCloud IQ - Site Engine", "vendor": "Extreme Networks", "versions": [{"changes": [{"at": "26.02.11", "status": "unaffected"}], "lessThanOrEqual": "<=25.12.11", "status": "affected", "version": "25.5.12.6", "versionType": "custom"}]}], "configurations": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "NAC administrator privlege required.&nbsp;"}], "value": "NAC administrator privlege required."}], "credits": [{"lang": "en", "type": "finder", "value": "Lockheed Martin Red Team"}], "datePublic": "2026-03-02T14:07:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgba(206, 206, 217, 0.004);\">In ExtremeCloud IQ \u2013 Site Engine (XIQ\u2011SE) before 26.2.10, a vulnerability in the NAC administration interface allows an authenticated NAC administrator to retrieve masked sensitive parameters from HTTP responses. Although credentials appear redacted in the user interface, the application returns the underlying credential values in the HTTP response, enabling an authorized administrator to recover stored secrets that may exceed their intended access.\n<br><br><br>\nWe would like to thank the Lockheed Martin Red Team for responsibly reporting this issue and working with us through coordinated disclosure.</span>"}], "value": "In ExtremeCloud IQ \u2013 Site Engine (XIQ\u2011SE) before 26.2.10, a vulnerability in the NAC administration interface allows an authenticated NAC administrator to retrieve masked sensitive parameters from HTTP responses. Although credentials appear redacted in the user interface, the application returns the underlying credential values in the HTTP response, enabling an authorized administrator to recover stored secrets that may exceed their intended access.\n\n\n\n\nWe would like to thank the Lockheed Martin Red Team for responsibly reporting this issue and working with us through coordinated disclosure."}], "impacts": [{"capecId": "CAPEC-37", "descriptions": [{"lang": "en", "value": "CAPEC-37 Retrieve Embedded Sensitive Data"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 6, "baseSeverity": "MEDIUM", "exploitMaturity": "UNREPORTED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-522", "description": "CWE-522 Insufficiently Protected Credentials", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "1c053176-eef3-4d6a-ae0b-24728c86587b", "shortName": "ExtremeNetworks", "dateUpdated": "2026-03-02T16:38:23.688Z"}, "references": [{"url": "https://extreme-networks.my.site.com/ExtrArticleDetail?an=000134325"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgba(206, 206, 217, 0.02);\">Fixed in 26.2.10 or later.</span>\n\n<br>"}], "value": "Fixed in 26.2.10 or later."}], "source": {"advisory": "SA-2026-020", "discovery": "UNKNOWN"}, "title": "XIQ\u2011SE NAC Admin Credential Exposure via HTTP Response", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-02T19:17:27.896047Z", "id": "CVE-2026-0689", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-02T19:17:37.551Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0689", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-02T19:17:27.896047Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-02T19:17:33.383Z"}}], "cna": {"title": "XIQ\u2011SE NAC Admin Credential Exposure via HTTP Response", "source": {"advisory": "SA-2026-020", "discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Lockheed Martin Red Team"}], "impacts": [{"capecId": "CAPEC-37", "descriptions": [{"lang": "en", "value": "CAPEC-37 Retrieve Embedded Sensitive Data"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U", "exploitMaturity": "UNREPORTED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Extreme Networks", "product": "ExtremeCloud IQ - Site Engine", "versions": [{"status": "affected", "changes": [{"at": "26.02.11", "status": "unaffected"}], "version": "25.5.12.6", "versionType": "custom", "lessThanOrEqual": "<=25.12.11"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Fixed in 26.2.10 or later.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgba(206, 206, 217, 0.02);\">Fixed in 26.2.10 or later.</span>\n\n<br>", "base64": false}]}], "datePublic": "2026-03-02T14:07:00.000Z", "references": [{"url": "https://extreme-networks.my.site.com/ExtrArticleDetail?an=000134325"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "In ExtremeCloud IQ \u2013 Site Engine (XIQ\u2011SE) before 26.2.10, a vulnerability in the NAC administration interface allows an authenticated NAC administrator to retrieve masked sensitive parameters from HTTP responses. Although credentials appear redacted in the user interface, the application returns the underlying credential values in the HTTP response, enabling an authorized administrator to recover stored secrets that may exceed their intended access.\n\n\n\n\nWe would like to thank the Lockheed Martin Red Team for responsibly reporting this issue and working with us through coordinated disclosure.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgba(206, 206, 217, 0.004);\">In ExtremeCloud IQ \u2013 Site Engine (XIQ\u2011SE) before 26.2.10, a vulnerability in the NAC administration interface allows an authenticated NAC administrator to retrieve masked sensitive parameters from HTTP responses. Although credentials appear redacted in the user interface, the application returns the underlying credential values in the HTTP response, enabling an authorized administrator to recover stored secrets that may exceed their intended access.\n<br><br><br>\nWe would like to thank the Lockheed Martin Red Team for responsibly reporting this issue and working with us through coordinated disclosure.</span>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-522", "description": "CWE-522 Insufficiently Protected Credentials"}]}], "configurations": [{"lang": "en", "value": "NAC administrator privlege required.", "supportingMedia": [{"type": "text/html", "value": "NAC administrator privlege required.&nbsp;", "base64": false}]}], "providerMetadata": {"orgId": "1c053176-eef3-4d6a-ae0b-24728c86587b", "shortName": "ExtremeNetworks", "dateUpdated": "2026-03-02T16:38:23.688Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0689", "state": "PUBLISHED", "dateUpdated": "2026-03-02T19:17:37.551Z", "dateReserved": "2026-01-07T20:12:47.064Z", "assignerOrgId": "1c053176-eef3-4d6a-ae0b-24728c86587b", "datePublished": "2026-03-02T15:16:44.054Z", "assignerShortName": "ExtremeNetworks"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "ExtremeCloud IQ - Site Engine", "vendor": "Extreme Networks", "versions": [{"changes": [{"at": "26.02.11", "status": "unaffected"}], "lessThanOrEqual": "<=25.12.11", "status": "affected", "version": "25.5.12.6", "versionType": "custom"}]}], "source": "1c053176-eef3-4d6a-ae0b-24728c86587b"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:extremenetworks:extremecloud_iq_site_engine:*:*:*:*:*:*:*:*", "matchCriteriaId": "A0FF0B71-C583-4ECA-B269-3D65954D1634", "versionEndExcluding": "26.2.10", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In ExtremeCloud IQ \u2013 Site Engine (XIQ\u2011SE) before 26.2.10, a vulnerability in the NAC administration interface allows an authenticated NAC administrator to retrieve masked sensitive parameters from HTTP responses. Although credentials appear redacted in the user interface, the application returns the underlying credential values in the HTTP response, enabling an authorized administrator to recover stored secrets that may exceed their intended access.\n\n\n\n\nWe would like to thank the Lockheed Martin Red Team for responsibly reporting this issue and working with us through coordinated disclosure."}, {"lang": "es", "value": "En ExtremeCloud IQ \u2013 Site Engine (XIQ?SE) anterior a la versi\u00f3n 26.2.10, una vulnerabilidad en la interfaz de administraci\u00f3n de NAC permite a un administrador de NAC autenticado recuperar par\u00e1metros sensibles enmascarados de las respuestas HTTP. Aunque las credenciales aparecen redactadas en la interfaz de usuario, la aplicaci\u00f3n devuelve los valores de credenciales subyacentes en la respuesta HTTP, lo que permite a un administrador autorizado recuperar secretos almacenados que pueden exceder su acceso previsto.\n\nNos gustar\u00eda agradecer al Equipo Rojo de Lockheed Martin por informar responsablemente sobre este problema y trabajar con nosotros a trav\u00e9s de una divulgaci\u00f3n coordinada."}], "id": "CVE-2026-0689", "lastModified": "2026-06-17T10:11:12.607", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.0, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "1c053176-eef3-4d6a-ae0b-24728c86587b", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0689", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-02T19:17:27.896047Z", "version": "2.0.3"}}]}, "published": "2026-03-02T16:16:23.653", "references": [{"source": "1c053176-eef3-4d6a-ae0b-24728c86587b", "tags": ["Vendor Advisory"], "url": "https://extreme-networks.my.site.com/ExtrArticleDetail?an=000134325"}], "sourceIdentifier": "1c053176-eef3-4d6a-ae0b-24728c86587b", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-522"}], "source": "1c053176-eef3-4d6a-ae0b-24728c86587b", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[25.5.12.6,25.12.11]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "ExtremeCloud IQ - Site Engine", "source": "cna", "vendor": "Extreme Networks"}, "product": "extremecloud_iq_-_site_engine", "vendor": "extremenetworks"}], "analysis": {"en": {"generated_at": "2026-04-16T14:33:07.556219+00:00", "value": {"mitigation_remediation": ["Apply the vendor-published update to version 26.2.10 or later.", "Apply least\u2011privilege controls to NAC administrators, limiting their ability to access privileged endpoints. ", "Configure the application or web\u2011application firewall to strip sensitive values from all HTTP responses sent to administrators."], "summary": {"action": "Patch Now", "impact": "Credential Exposure"}, "threat_synthesis": {"affected_systems": "Extreme Networks\u2019 ExtremeCloud IQ \u2013 Site Engine, versions prior to 26.2.10. The vulnerability was fixed in 26.2.10 and later releases.", "description_and_impact": "A flaw in the NAC administration interface of ExtremeCloud IQ \u2013 Site Engine enables an authenticated administrator to receive HTTP responses containing fully resolved credential values, despite the UI showing masked entries. The attacker can thus recover stored secrets that are intended to be protected. This constitutes a direct disclosure of sensitive authentication data, potentially allowing privilege escalation within the network visibility and control plane.", "risk_and_exploitability": "The CVSS score of 6 indicates moderate severity. EPSS is less than 1%, suggesting low current exploitation probability, but the issue is not listed in CISA\u2019s KEV. Because the exploit requires an authenticated NAC administrator, the attack is limited to privileged users. Nonetheless, compromised credentials could lead to broad lateral movement or control over network devices. Organizations should treat this as a moderate risk that warrants prompt remediation."}}}}, "created": "2026-03-03T08:44:50.270601+00:00", "updated": "2026-04-16T14:45:25.928754+00:00", "vendors": ["extremenetworks", "extremenetworks$PRODUCT$extremecloud_iq_-_site_engine"]}