Extreme Platform ONE CVE-2026-9831

Exploitation requires possession of a valid Extreme Platform ONE IAM-issued API key (PR:L - low privileges authenticated; CVSS-confirmed). The race condition only manifests under 'specific high-concurrency traffic conditions' as stated in the description - the attack window does not exist in low-traffic environments, meaning exploitation likelihood is coupled to platform load rather than purely attacker-controlled. Only the IAM Gateway API-key authentication code path is vulnerable; XIQ-native token authentication and OAuth/Bearer JWT authentication are explicitly confirmed unaffected by the vendor, limiting the attack surface to integrations specifically using IAM-issued API keys. Attack complexity is rated High (AC:H) in CVSS, confirming that the race window is non-trivial to trigger reliably. Exploitation does not require user interaction (UI:N) and operates over the network (AV:N). Limiting factors for defenders: restricting or eliminating IAM API key usage in favor of JWT authentication entirely removes exposure; the dependency on high concurrency means isolated or lightly loaded deployments face materially lower practical risk.

The CVSS base score of 6.3 (Medium) reflects the high attack complexity (AC:H) and low-privilege requirement (PR:L), but this framing underweights the real-world business risk for multi-tenant deployments. The Changed Scope (S:C) and High Confidentiality impact (C:H) signal that a successful exploit breaks tenant isolation - a catastrophic outcome in shared SaaS environments where regulatory compliance (GDPR, HIPAA, SOC 2) depends on strict data segregation. The AC:H rating is accurate: exploitation is not trivially repeatable and requires an attacker to hit the race window under elevated concurrency, making reliable, on-demand exploitation difficult. EPSS data was not provided in the input, so exploitation probability cannot be quantified. No CISA KEV listing exists and no POC has been identified, suggesting no observed active exploitation at time of analysis. For tenants co-located on busy shared infrastructure or high-traffic XIQ deployments, the effective risk is materially higher than the base score implies, because the race condition becomes more likely as legitimate traffic volume increases - meaning attacker effort decreases as platform scale increases.

An attacker holding a valid Extreme Platform ONE IAM-issued API key for their own tenant times a burst of concurrent API requests to coincide with high-volume legitimate traffic on the shared platform, creating the race condition window in the IAM Gateway authentication path. During that window, the gateway incorrectly maps a response intended for a co-tenant to the attacker's request context, returning that tenant's data - such as network configuration, device inventory, or user records - to the attacker. No POC has been identified at time of analysis, and reliable exploitation requires both an IAM API key and the ability to influence or observe concurrent request volume.