CVE-2026-9831

Medium

Description

A race condition in the shared Extreme Platform ONE IAM Gateway API-key authentication path could, under specific high-concurrency traffic conditions, intermittently allow requests authenticated with an Extreme Platform ONE /IAM-issued API key to receive response data for another tenant. The issue was observed through ExtremeCloud IQ/XIQ API endpoints and validated against both XIQ/XAPI and Extreme Platform ONE /Common Services API paths. XIQ-native tokens and standard OAuth/Bearer JWT authentication were not affected.

SeverityMedium

CVSS6.3

Exploit probability—

ProductExtreme Platform ONE

PublishedMay 29, 2026

First seenMay 29, 2026

Weakness typeCWE-362Race condition CWE-488CWE-488

How to fix

Update

Extreme Networks Extreme Platform ONE25.10.0-104 or later

Vendor advisories

community.extremenetworks.com/t5/security-advisories-formerly/sa-2026-048-extremecloud-iq-cross-tenant-data-exposure-via/ba-p/121851

Affected products

Product	Affected versions	Fixed in
Extreme Networks Extreme Platform ONE	v < 25.10.0-104	25.10.0-104

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.