Which versions of Microchip IStaX are affected by CVE-2026-2336?

Microchip IStaX versions before 2026.03 contain a privilege escalation defect allowing any user with a web login to assume full administrator privileges.. A patch is available.

How to fix or mitigate CVE-2026-2336?

Within 24 hours, inventory all Microchip IStaX instances and verify current versions; flag any running versions before 2026.03 as requiring immediate remediation. Within 7 days, deploy Microchip IStaX 2026.03 or later across all affected systems, prioritizing internet-facing and production-critical instances. Within 30 days, conduct a security audit of privileged account activity and authentication logs during the exposure period, and complete version verification across your infrastructure to confirm successful remediation.

Microchip IStaX CVE-2026-2336

Q: What is the CVSS score of CVE-2026-2336?

CVE-2026-2336 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-23272 HIGH

Insufficient Entropy (CWE-331)

2026-04-16 Microchip

Privilege Escalation Istax Microchip

8.7

CVSS 4.0 · Vendor: Microchip

Severity by source

Vendor (Microchip) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Authenticated low-priv web access (PR:L) over the network (AV:N) plus non-trivial secret recovery (AC:H) yields full admin control (C:H/I:H/A:H) within the same device (S:U).

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Microchip).

CVSS VectorVendor: Microchip

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 07:32 vuln.today

Patch released

Apr 17, 2026 - 15:17 nvd

Patch available

Apr 16, 2026 - 18:02 EUVD

EUVD ID Assigned

Apr 16, 2026 - 17:45 euvd

EUVD-2026-23272

CVE Published

Apr 16, 2026 - 17:02 nvd

HIGH 8.7

DescriptionCVE.org

A privilege escalation vulnerability in Microchip IStaX allows an authenticated low-privileged user to recover a shared per-device cookie secret from their own webstax_auth session cookie and forge a new cookie with administrative privileges.This issue affects IStaX before 2026.03.

AnalysisAI

Privilege escalation in Microchip IStaX before 2026.03 allows an authenticated low-privileged web user to derive the shared per-device cookie secret directly from their own webstax_auth session cookie and mint a forged cookie granting full administrative access. Because the secret is common to the device rather than per-user and can be reconstructed from an already-issued cookie, any account holder can self-elevate to admin. There is no public exploit identified at time of analysis, and EPSS is very low (0.04%), but the technical impact is total.

Technical ContextAI

IStaX is Microchip's managed Ethernet switch firmware stack (part of the WebStaX/SMBStaX/IStaX family) that exposes a web management interface authenticated via a 'webstax_auth' HTTP session cookie. The flaw is rooted in CWE-331 (Insufficient Entropy): the cookie's integrity depends on a secret that is shared across the whole device instead of being unique and unpredictable per user or session. Because that secret is derivable from the contents of a legitimately issued cookie, the cryptographic binding meant to prevent tampering fails, letting an attacker recompute a valid signature for an arbitrary privilege level. The single affected product is identified by CPE cpe:2.3:a:microchip:istax:*:*:*:*:*:*:*:* across all versions prior to 2026.03.

RemediationAI

Upgrade IStaX to version 2026.03 or later, which the vendor states contains the fix (Vendor-released patch: 2026.03); consult the Microchip advisory at https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/istax-privilege-escalation-via-weak-cookie-authentication for the exact release and upgrade guidance. Until the update is applied, reduce exposure by restricting the switch web management interface to trusted management networks or a dedicated VLAN and limiting who can obtain even a low-privileged web account, since exploitation requires an authenticated foothold; where feasible, disable the HTTP/HTTPS web UI in favor of CLI/SNMP management, accepting the trade-off of losing browser-based administration. Because the weak secret is shared per device, also rotate credentials and force re-authentication after upgrading, as any previously issued cookie could have been captured for later forgery.