# CVE-2026-105440: Switch Engine (EXOS) JSON-RPC Authorization Bypass Allows Read-Only Users to Disclose Sensitive Information

Status: published. Published: 2026-11-11. Updated: 2026-11-11.

Missing authorization in the JSON-RPC web services interface
of Extreme Networks Switch Engine (EXOS) allows an authenticated,
low-privileged (read-only) user to execute CLI show commands that are
restricted to that role through the command line interface. Successful
exploitation results in disclosure of sensitive information, including the
device configuration and the password hashes of local accounts. Configuration,
enable, and debug commands are not affected. Disclosed password hashes can be
attacked offline, and a weak password could lead to administrative access to
the device. This issue is fixed in Switch Engine 33.7.1-patch1-11,
33.1.100.133-patch1-9, and 32.7.4.15-patch1-11.








Extreme Networks would like to thank Toàn Lê (GitHub: https://github.com/toanln-cov) for responsibly disclosing this vulnerability and for working with our PSIRT team through coordinated disclosure.

## Remediation

- fix: Upgrade
to Switch Engine 33.7.1-patch1-11, 33.1.100.133-patch1-9, or
32.7.4.15-patch1-11, or later.After
upgrading, rotate local account passwords, especially administrative accounts. (source: CNA: ExtremeNetworks)
- workaround: Restrict access to the device management interface to
trusted networks and hosts. Disable the web services (JSON-RPC) interface where
it is not required. Limit read-only accounts to users who require them, and
enforce strong, unique passwords on all local accounts. (source: CNA: ExtremeNetworks)

## Affected products and versions

- Extreme Networks / Switch Engine (EXOS): ≥ 33.7.0; < 33.7.1-patch1-11 (affected, custom); ≥ 33.1.0; < 33.1.100-patch1-9 (affected, custom); ≥ 32.0.0; < 32.7.4.15-patch1-11 (affected, custom). Source: CNA: ExtremeNetworks

## Severity and prioritization

- CVSS 4.0: 8.3 (high); CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N; source: CNA: ExtremeNetworks

- CVSS 3.1: 6.5 (medium); CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N; source: CNA: ExtremeNetworks

- CVSS 4.0: 8.3 (high); CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X; source: NVD: 1c053176-eef3-4d6a-ae0b-24728c86587b

- CVSS 3.1: 6.5 (medium); CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N; source: NVD: 1c053176-eef3-4d6a-ae0b-24728c86587b

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-862

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://extreme-networks.my.site.com/ExtrArticleDetail?an=000140004 (CNA: ExtremeNetworks)

- https://extreme-networks.my.site.com/ExtrArticleDetail?an=000140004 (1c053176-eef3-4d6a-ae0b-24728c86587b)

## Provenance

- CNA: ExtremeNetworks: https://www.cve.org/CVERecord?id=CVE-2026-105440; retrieved 2026-11-11; source updated 2026-11-11

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-105440; retrieved 2026-11-11; source updated 2026-11-11

Revision: 4f32d8917e019723080d65a33eb2308a87ef4e112913037883cebad5476280ac

Canonical: https://y2.dev/cve/CVE-2026-105440

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.