CVE-2026-9831 — ExtremeCloud IQ Cross Tenant Data Exposure via Extreme Platform One Authentication Race Condition
A race condition in the shared Extreme Platform ONE IAM Gateway API-key authentication path could, under specific high-concurrency traffic conditions, intermittently allow reque…
Published: 2026-05-29 · CVSS: 6.3 · CVSS 3.1
A race condition in the shared Extreme Platform ONE IAM Gateway API-key authentication path could, under specific high-concurrency traffic conditions, intermittently allow requests authenticated with an Extreme Platform ONE /IAM-issued API key to receive response data for another tenant. The issue was observed through ExtremeCloud IQ/XIQ API endpoints and validated against both XIQ/XAPI and Extreme Platform ONE /Common Services API paths. XIQ-native tokens and standard OAuth/Bearer JWT authentication were not affected.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7