https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-0689.htmlhttps://patchthecve.com/cve/CVE-2026-0689.htmlWed, 17 Jun 2026 10:11:12 +0000MEDIUM 4.9: In ExtremeCloud IQ – Site Engine (XIQ‑SE) before 26.2.10, a vulnerability in the NAC administration interface allows an authenticated NAC administrator to retrieve masked sensitive parameters from HTTP responses. Although credentials appear redacted in the user interface, the application returns thehttps://patchthecve.com/cve/CVE-2025-11192.htmlhttps://patchthecve.com/cve/CVE-2025-11192.htmlThu, 08 Oct 2026 22:10:00 +0000HIGH 8.6: A vulnerability in Extreme Networks’ Fabric Engine (VOSS) before 9.3 was discovered. When SD-WAN AutoSense is enabled on a port, it may automatically configure fabric connectivity without validating ISIS authentication settings. The SD-WAN AutoSense implementation may be exploited by malicious actorhttps://patchthecve.com/cve/CVE-2025-8679.htmlhttps://patchthecve.com/cve/CVE-2025-8679.htmlMon, 12 Oct 2026 15:10:00 +0000CRITICAL 9.8: In ExtremeGuest Essentials before 25.5.0, captive-portal may permit unauthorized access via manual brute-force procedure. Under certain ExtremeGuest Essentials captive-portal SSID configurations, repeated manual login attempts may allow an unauthenticated device to be marked as authenticated and obthttps://patchthecve.com/cve/CVE-2025-6235.htmlhttps://patchthecve.com/cve/CVE-2025-6235.htmlWed, 17 Jun 2026 10:01:26 +0000MEDIUM 6.1: In ExtremeControl before 25.5.12, a cross-site scripting (XSS) vulnerability was discovered in a login interface of the affected application. The issue stems from improper handling of user-supplied input within HTML attributes, allowing an attacker to inject script code that may execute in a user's https://patchthecve.com/cve/CVE-2025-6083.htmlhttps://patchthecve.com/cve/CVE-2025-6083.htmlWed, 17 Jun 2026 10:01:07 +0000MEDIUM 4.3: In ExtremeCloud Universal ZTNA, a syntax error in the 'searchKeyword' condition caused queries to bypass the owner_id filter. This issue may allow users to search data across the entire table instead of being restricted to their specific owner_id.https://patchthecve.com/cve/CVE-2024-38292.htmlhttps://patchthecve.com/cve/CVE-2024-38292.htmlWed, 17 Jun 2026 07:39:53 +0000CRITICAL 9.8: In Extreme Networks XIQ-SE before 24.2.11, due to a missing access control check, a path traversal is possible, which may lead to privilege escalation.https://patchthecve.com/cve/CVE-2024-38291.htmlhttps://patchthecve.com/cve/CVE-2024-38291.htmlWed, 17 Jun 2026 07:39:53 +0000HIGH 8.8: In XIQ-SE before 24.2.11, a low-privileged user may be able to access admin passwords, which could lead to privilege escalation.https://patchthecve.com/cve/CVE-2024-38290.htmlhttps://patchthecve.com/cve/CVE-2024-38290.htmlWed, 17 Jun 2026 07:39:52 +0000MEDIUM 5.3: In XIQ-SE before 24.2.11, a server misconfiguration may allow user enumeration when specific conditions are met.https://patchthecve.com/cve/CVE-2020-18305.htmlhttps://patchthecve.com/cve/CVE-2020-18305.htmlWed, 17 Jun 2026 02:59:15 +0000HIGH 8.0: Extreme Networks EXOS before v.22.7 and before v.30.2 was discovered to contain an issue in its Web GUI which fails to restrict URL access, allowing attackers to access sensitive information or escalate privileges.https://patchthecve.com/cve/CVE-2024-27453.htmlhttps://patchthecve.com/cve/CVE-2024-27453.htmlWed, 17 Jun 2026 07:19:55 +0000HIGH 8.6: In Extreme XOS through 22.6.1.4, a read-only user can escalate privileges to root via a crafted HTTP POST request to the python method of the Machine-to-Machine Interface (MMI).