What’s Vulnerable › Vulnerabilities
CVE-2025-11192: Fabric Engine (VOSS) AutoSense Authentication Bypass
- Severity: high (CVSS 8.6 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-10-07 · updated 2026-10-08
- Weakness: CWE-287
Description
A vulnerability in Extreme Networks’ Fabric Engine (VOSS) before 9.3 was discovered. When SD-WAN AutoSense is enabled on a port, it may automatically configure fabric connectivity without validating ISIS authentication settings. The SD-WAN AutoSense implementation may be exploited by malicious actors by allowing unauthorized access to network fabric and configuration data.
Affected products
- Extreme Networks Fabric Engine (VOSS): before 9.3 — fixed in 9.3
How to fix
Upgrade to a fixed version: Extreme Networks Fabric Engine (VOSS) 9.3. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-11192 or the next vulnerability affects your stack