CVE-2026-8169 describes a vulnerability in Extreme Networks Switch Engine (EXOS) where the challenge value used in the debug-mode authorization challenge-response mechanism is generated using an insufficiently random source (CWE-338). This weak pseudo-random number generator can under certain conditions allow an attacker to predict the expected response, bypassing authorization controls. Exploitation requires either a valid low-privilege account on the device remotely or physical serial console access locally. If exploited, it may enable escalation to root-level privileges and persistent modification of the device's software stack. The vulnerability affects EXOS versions 32.0.0, 33.0.0, and 33.2.0. There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported.

An attacker with low-privilege access or physical serial console access can potentially bypass the debug-mode authorization mechanism by predicting the challenge response due to weak randomness. This can lead to unauthorized activation of debug-mode, escalation to root-level access, and persistent modification of the device software stack, posing a significant risk to device integrity and security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to low-privilege accounts and physical console interfaces to trusted personnel only. Monitor for vendor updates regarding patches or mitigations specific to this vulnerability.