Which versions of Switch Engine Exos are affected by CVE-2026-8170?

Extreme Networks ExtremeXOS switches contain a privilege escalation vulnerability allowing authenticated CLI users to gain root access and persistently modify device firmware and configuration.. A patch is available.

How to fix or mitigate CVE-2026-8170?

Within 24 hours: inventory all Extreme Networks ExtremeXOS devices and immediately restrict CLI access to authorized administrative personnel only; review recent access logs for unauthorized user activity and symlink operations. Within 7 days: implement network segmentation restricting switch management access to trusted administrative networks; enable detailed CLI command auditing focused on file operation utilities (mv, cp, rm) with real-time alerting; begin daily monitoring of Extreme Networks security advisories for patch availability. Within 30 days: develop and execute a patching deployment plan once vendor releases a fix with a target implementation timeline; conduct comprehensive access control audit across all switches to enforce principle of least privilege; review and document all interim compensating controls in your incident response procedures.

Switch Engine Exos CVE-2026-8170

Q: What is the CVSS score of CVE-2026-8170?

CVE-2026-8170 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-46048 HIGH

Improper Link Resolution Before File Access (CWE-59)

2026-07-20 ExtremeNetworks

GHSA-x4hp-453h-hp48

Privilege Escalation Switch Engine Exos

8.7

CVSS 4.0 · Vendor: ExtremeNetworks

Severity by source

Vendor (ExtremeNetworks) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (ExtremeNetworks) · only source for this CVE.

CVSS VectorVendor: ExtremeNetworks

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 20, 2026 - 19:03 EUVD

Analysis Generated

Jul 20, 2026 - 18:18 vuln.today

CVE Published

Jul 20, 2026 - 17:34 cve.org

HIGH 8.7

DescriptionCVE.org

The mv, cp, and rm file utilities exposed within the ExtremeXOS (EXOS) shell environment fail to safely canonicalize paths and follow symbolic links outside of the intended privilege boundary. An attacker with low-privilege CLI access can create a symbolic link that references a privileged filesystem location and then invoke the affected utilities to read, modify, or replace security-critical files outside of their authorized scope. Under certain conditions, this may enable escalation to root-level access and persistent modification of the device software stack. Exploitation is possible remotely by an attacker holding a low-privilege account, or locally via the serial console.

AnalysisAI

Privilege escalation in Extreme Networks ExtremeXOS (Switch Engine) EXOS shell allows a low-privileged CLI user to abuse the built-in mv, cp, and rm utilities to escape their authorized filesystem scope and tamper with security-critical files. Because these utilities follow symbolic links without safely canonicalizing paths, an attacker can plant a symlink to a privileged location and, under certain conditions, escalate to root and persistently modify the device software stack. Reported by Extreme Networks with a CVSS 4.0 score of 8.7 (High); no public exploit identified at time of analysis, and it is not listed in CISA KEV.