CVE-2026-9831

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-9831", "assignerOrgId": "1c053176-eef3-4d6a-ae0b-24728c86587b", "state": "PUBLISHED", "assignerShortName": "ExtremeNetworks", "dateReserved": "2026-05-28T12:21:45.520Z", "datePublished": "2026-05-29T21:19:17.118Z", "dateUpdated": "2026-06-01T13:53:05.140Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1c053176-eef3-4d6a-ae0b-24728c86587b", "shortName": "ExtremeNetworks", "dateUpdated": "2026-05-29T21:19:17.118Z"}, "title": "ExtremeCloud IQ Cross Tenant Data Exposure via Extreme Platform One Authentication Race Condition", "datePublic": "2026-05-29T21:09:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-362", "description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition)", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-488", "description": "CWE-488 Exposure of data element to wrong session", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-74", "descriptions": [{"lang": "en", "value": "CAPEC-74: Manipulating State"}]}], "affected": [{"vendor": "Extreme Networks", "product": "Extreme Platform ONE", "platforms": ["SaaS (Cloud Hosted)"], "versions": [{"status": "affected", "version": "0", "lessThan": "25.10.0-104", "versionType": "custom"}, {"status": "unaffected", "version": "25.10.0-104", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "A race condition in the shared Extreme Platform\nONE IAM Gateway API-key authentication path could, under specific\nhigh-concurrency traffic conditions, intermittently allow requests\nauthenticated with an Extreme Platform ONE /IAM-issued API key to receive\nresponse data for another tenant. The issue was observed through ExtremeCloud\nIQ/XIQ API endpoints and validated against both XIQ/XAPI and Extreme Platform ONE\n/Common Services API paths. XIQ-native tokens and standard OAuth/Bearer JWT\nauthentication were not affected.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "A race condition in the shared Extreme Platform\nONE IAM Gateway API-key authentication path could, under specific\nhigh-concurrency traffic conditions, intermittently allow requests\nauthenticated with an Extreme Platform ONE /IAM-issued API key to receive\nresponse data for another tenant. The issue was observed through ExtremeCloud\nIQ/XIQ API endpoints and validated against both XIQ/XAPI and Extreme Platform ONE\n/Common Services API paths. XIQ-native tokens and standard OAuth/Bearer JWT\nauthentication were not affected."}]}], "references": [{"url": "https://community.extremenetworks.com/t5/security-advisories-formerly/sa-2026-048-extremecloud-iq-cross-tenant-data-exposure-via/ba-p/121851", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N"}}], "credits": [{"lang": "en", "value": "Sebastian Koller of Iteas IT Services GmbH (Austria) for responsible discovery and disclosure of this vulnerability.", "type": "finder"}, {"lang": "en", "value": "Sebastian Koller of Iteas IT Services GmbH (Austria) for responsible coordination and providing detailed evidence supporting root cause identification.", "type": "reporter"}], "source": {"advisory": "SA-2026-048", "discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-01T13:52:52.575235Z", "id": "CVE-2026-9831", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-01T13:53:05.140Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-9831", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-01T13:52:52.575235Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-01T13:53:00.145Z"}}], "cna": {"title": "ExtremeCloud IQ Cross Tenant Data Exposure via Extreme Platform One Authentication Race Condition", "source": {"advisory": "SA-2026-048", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Sebastian Koller of Iteas IT Services GmbH (Austria) for responsible discovery and disclosure of this vulnerability."}, {"lang": "en", "type": "reporter", "value": "Sebastian Koller of Iteas IT Services GmbH (Austria) for responsible coordination and providing detailed evidence supporting root cause identification."}], "impacts": [{"capecId": "CAPEC-74", "descriptions": [{"lang": "en", "value": "CAPEC-74: Manipulating State"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Extreme Networks", "product": "Extreme Platform ONE", "versions": [{"status": "affected", "version": "0", "lessThan": "25.10.0-104", "versionType": "custom"}, {"status": "unaffected", "version": "25.10.0-104", "versionType": "custom"}], "platforms": ["SaaS (Cloud Hosted)"], "defaultStatus": "unaffected"}], "datePublic": "2026-05-29T21:09:00.000Z", "references": [{"url": "https://community.extremenetworks.com/t5/security-advisories-formerly/sa-2026-048-extremecloud-iq-cross-tenant-data-exposure-via/ba-p/121851", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "A race condition in the shared Extreme Platform\nONE IAM Gateway API-key authentication path could, under specific\nhigh-concurrency traffic conditions, intermittently allow requests\nauthenticated with an Extreme Platform ONE /IAM-issued API key to receive\nresponse data for another tenant. The issue was observed through ExtremeCloud\nIQ/XIQ API endpoints and validated against both XIQ/XAPI and Extreme Platform ONE\n/Common Services API paths. XIQ-native tokens and standard OAuth/Bearer JWT\nauthentication were not affected.", "supportingMedia": [{"type": "text/html", "value": "A race condition in the shared Extreme Platform\nONE IAM Gateway API-key authentication path could, under specific\nhigh-concurrency traffic conditions, intermittently allow requests\nauthenticated with an Extreme Platform ONE /IAM-issued API key to receive\nresponse data for another tenant. The issue was observed through ExtremeCloud\nIQ/XIQ API endpoints and validated against both XIQ/XAPI and Extreme Platform ONE\n/Common Services API paths. XIQ-native tokens and standard OAuth/Bearer JWT\nauthentication were not affected.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-362", "description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition)"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-488", "description": "CWE-488 Exposure of data element to wrong session"}]}], "providerMetadata": {"orgId": "1c053176-eef3-4d6a-ae0b-24728c86587b", "shortName": "ExtremeNetworks", "dateUpdated": "2026-05-29T21:19:17.118Z"}}}, "cveMetadata": {"cveId": "CVE-2026-9831", "state": "PUBLISHED", "dateUpdated": "2026-06-01T13:53:05.140Z", "dateReserved": "2026-05-28T12:21:45.520Z", "assignerOrgId": "1c053176-eef3-4d6a-ae0b-24728c86587b", "datePublished": "2026-05-29T21:19:17.118Z", "assignerShortName": "ExtremeNetworks"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["SaaS (Cloud Hosted)"], "product": "Extreme Platform ONE", "vendor": "Extreme Networks", "versions": [{"lessThan": "25.10.0-104", "status": "affected", "version": "0", "versionType": "custom"}, {"status": "unaffected", "version": "25.10.0-104", "versionType": "custom"}]}], "source": "1c053176-eef3-4d6a-ae0b-24728c86587b"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A race condition in the shared Extreme Platform\nONE IAM Gateway API-key authentication path could, under specific\nhigh-concurrency traffic conditions, intermittently allow requests\nauthenticated with an Extreme Platform ONE /IAM-issued API key to receive\nresponse data for another tenant. The issue was observed through ExtremeCloud\nIQ/XIQ API endpoints and validated against both XIQ/XAPI and Extreme Platform ONE\n/Common Services API paths. XIQ-native tokens and standard OAuth/Bearer JWT\nauthentication were not affected."}, {"lang": "es", "value": "Una condici\u00f3n de carrera en la ruta de autenticaci\u00f3n de clave API compartida del IAM Gateway de Extreme Platform ONE podr\u00eda, bajo condiciones espec\u00edficas de tr\u00e1fico de alta concurrencia, permitir intermitentemente que las solicitudes autenticadas con una clave API emitida por Extreme Platform ONE /IAM reciban datos de respuesta para otro inquilino. El problema se observ\u00f3 a trav\u00e9s de los puntos finales de la API de ExtremeCloud IQ/XIQ y se valid\u00f3 tanto contra las rutas de la API de XIQ/XAPI como las de Extreme Platform ONE /Common Services. Los tokens nativos de XIQ y la autenticaci\u00f3n est\u00e1ndar OAuth/Bearer JWT no se vieron afectados."}], "id": "CVE-2026-9831", "lastModified": "2026-07-22T06:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 4.0, "source": "1c053176-eef3-4d6a-ae0b-24728c86587b", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-9831", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-01T13:52:52.575235Z", "version": "2.0.3"}}]}, "published": "2026-05-29T22:16:23.980", "references": [{"source": "1c053176-eef3-4d6a-ae0b-24728c86587b", "url": "https://community.extremenetworks.com/t5/security-advisories-formerly/sa-2026-048-extremecloud-iq-cross-tenant-data-exposure-via/ba-p/121851"}], "sourceIdentifier": "1c053176-eef3-4d6a-ae0b-24728c86587b", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}, {"lang": "en", "value": "CWE-488"}], "source": "1c053176-eef3-4d6a-ae0b-24728c86587b", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["saas_(cloud_hosted)"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,25.10.0-104)"}}, {"platform": ["saas_(cloud_hosted)"], "status": "unaffected", "versions": {"scheme": "generic", "value": "25.10.0-104"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Extreme Platform ONE", "source": "cna", "vendor": "Extreme Networks"}, "product": "extreme_platform_one", "vendor": "extreme_networks"}], "created": "2026-05-29T23:00:14.648058+00:00", "updated": "2026-05-30T21:17:54.645575+00:00", "vendors": ["extreme_networks", "extreme_networks$PRODUCT$extreme_platform_one"]}