PT-2026-44998 · Extreme Networks · Extremecloud Iq+1

Sebastian Koller · CVE-2026-9831 · Published 2026-05-29 · Updated 2026-05-30

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ExtremeCloud IQ (affected versions not specified)

Description A race condition in the shared Extreme Platform ONE IAM Gateway API-key authentication path can intermittently allow requests authenticated with an Extreme Platform ONE /IAM-issued API key to receive response data belonging to another tenant under high-concurrency traffic conditions. This issue was observed through ExtremeCloud IQ/XIQ API endpoints and validated against both XIQ/XAPI and Extreme Platform ONE /Common Services API paths. This flaw has been exploited in real-world incidents to access cross-tenant data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Race Condition

Weakness Enumeration

CWE-362

CWE-488

Related Identifiers

CVE-2026-9831

Affected Products

Extreme Platform One

Extremecloud Iq

References · 5

• https://community.extremenetworks.com/t5/security-advisories-formerly/sa-2026-048-extremecloud-iq-cross-tenant-data-exposure-via/ba-p/121851 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-9831 · Security Note
• https://twitter.com/NewsNerdie/status/2060632965340602522 · Twitter Post
• https://t.me/cveNotify/165282 · Telegram Post
• https://t.me/CVEtracker/55315 · Telegram Post