We would like to thank the Lockheed Martin Red Team for responsibly reporting this issue and working with us through coordinated disclosure.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Extreme Networks | ExtremeCloud IQ - Site Engine | unaffected |
|
No data.
No data.
No data.
Project Subscriptions
No data.
No advisories yet.
Solution
Fixed in 26.2.10 or later.
Workaround
No workaround given by the vendor.
Mon, 02 Mar 2026 17:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | In ExtremeCloud IQ – Site Engine (XIQ‑SE) before 26.2.10, a vulnerability in the NAC administration interface allows an authenticated NAC administrator to retrieve masked sensitive parameters from HTTP responses. Although credentials appear redacted in the user interface, the application returns the underlying credential values in the HTTP response, enabling an authorized administrator to recover stored secrets that may exceed their intended access. We would like to thank the Lockheed Martin Red Team for responsibly reporting this issue and working with us through coordinated disclosure. | In ExtremeCloud IQ – Site Engine (XIQ‑SE) before 26.2.10, a vulnerability in the NAC administration interface allows an authenticated NAC administrator to retrieve masked sensitive parameters from HTTP responses. Although credentials appear redacted in the user interface, the application returns the underlying credential values in the HTTP response, enabling an authorized administrator to recover stored secrets that may exceed their intended access. We would like to thank the Lockheed Martin Red Team for responsibly reporting this issue and working with us through coordinated disclosure. |
Mon, 02 Mar 2026 15:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | In ExtremeCloud IQ – Site Engine (XIQ‑SE) before 26.2.10, a vulnerability in the NAC administration interface allows an authenticated NAC administrator to retrieve masked sensitive parameters from HTTP responses. Although credentials appear redacted in the user interface, the application returns the underlying credential values in the HTTP response, enabling an authorized administrator to recover stored secrets that may exceed their intended access. We would like to thank the Lockheed Martin Red Team for responsibly reporting this issue and working with us through coordinated disclosure. | |
| Title | XIQ‑SE NAC Admin Credential Exposure via HTTP Response | |
| Weaknesses | CWE-522 | |
| References |
| |
| Metrics |
cvssV4_0
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: ExtremeNetworks
Published:
Updated: 2026-03-02T16:38:23.688Z
Reserved: 2026-01-07T20:12:47.064Z
Link: CVE-2026-0689
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-03-02T16:16:23.653
Modified: 2026-03-02T17:16:28.893
Link: CVE-2026-0689
Redhat
No data.
OpenCVE Enrichment
No data.