Microchip IStaX CVE-2026-2336

Exploitation requires an authenticated low-privileged account on the IStaX web management interface (PR:L) and network reachability to that interface (AV:N); the attacker must possess a legitimately issued webstax_auth cookie and perform the cryptographic recovery of the device-shared cookie secret (reflected in AC:H and the AT:P present-attack-requirement). Limiting factors: valid credentials are mandatory (no unauthenticated path), the vulnerable version must be pre-2026.03, and the secret-recovery work is non-trivial and not automatable per CISA SSVC (Automatable: no), so this is not a point-and-click remote takeover despite the network vector.

The signals are mixed but coherent: the CVSS 4.0 base score is 8.7 (High) driven by total impact (VC:H/VI:H/VA:H) and network vector (AV:N), yet exploitation is gated by AC:H and AT:P (a present attack requirement) and PR:L, meaning the attacker must already hold a valid low-privileged login and perform non-trivial work to recover the secret. This aligns with CISA SSVC, which rates Exploitation as 'none' and Automatable as 'no' while confirming Technical Impact as 'total'. EPSS is very low at 0.04% (13th percentile), and there is no KEV listing and no known public exploit, so this is not evidence of active or widespread exploitation. Net assessment: a genuinely serious flaw for any environment where multiple users share a switch's web UI (full admin takeover from a low-priv account), but not an internet-scale mass-exploitation threat - prioritize patching where low-trust operator accounts exist, treat as lower urgency on single-admin deployments.

A user with a low-privileged IStaX web account logs in normally, captures their own webstax_auth cookie, and reverse-engineers the device-shared secret from it to compute a valid signature for an admin-level cookie. Replaying the forged cookie grants full administrative control of the switch. No public exploit code is currently known, and the CVSS AC:H/AT:P metrics indicate the secret-recovery step requires meaningful effort rather than a one-click attack.