IXP Manager CVE-2026-63339

Exploitation requires an authenticated, non-administrative IXP Manager account on the target instance (CVSS PR:L); it is network-reachable, needs no user interaction, and works against versions prior to 7.3.0. The practical attack surface depends on how many low-trust accounts exist - installations exposing member/customer self-service logins are most exposed, while single-operator deployments with no untrusted accounts have little exposure. The vendor states that restricting administrative functions per their 'Securing Administrative Functions' documentation significantly minimises risk but is NOT a complete fix; only upgrading to 7.3.0 fully remediates the flaw. The specific input-validation trigger is not detailed in the available sources.

The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a low-privilege, network-reachable, low-complexity flaw with no user interaction and full confidentiality/integrity/availability impact - consistent with the vendor-confirmed description of an authenticated non-admin user escalating to administrator. The key limiting signal is PR:L: an attacker must already hold a valid non-administrative IXP Manager account, so this is not an anonymous internet-facing bug but a trust-boundary break for existing users. The vuln.today decision label is 'this_week' (prioritise, not emergency), and INEX rates it high severity. No EPSS score, no CISA KEV listing, and no proof-of-concept or exploit reference were supplied, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk is real for any IXP Manager deployment that grants accounts to multiple parties (member/customer self-service portals), because a single low-trust account yields full administrative control; it is lower for tightly restricted single-operator installs. The vendor explicitly notes that restricting administrative functions per their hardening documentation reduces exposure but is NOT a complete fix - only upgrading to 7.3.0 fully resolves it.

An attacker holding a legitimate low-privilege IXP Manager account (for example a member/customer self-service login at an Internet Exchange) sends requests that the application fails to validate properly, elevating their own account to administrator. With admin rights they can then read and alter exchange configuration, peering data, and all other tenants' information. No public exploit code was provided in the sources, and exploitation requires valid authenticated access and no user interaction.