CVE-2026-88263CWE-306

CVE-2026-88263

High · published September 16, 2026

CVSS v3.0
7.5
EPSS
1%
Percentile
47.2
In the wild
Unconfirmed
What it is

XikeStor Layer3 switches miss authentication for downloading configuration data. Unauthenticated attacker may retrieve the configuration data containing network configurations and passwords to operate the affected product improperly or to exploit the affected product as a jump host.

The record
Technical detail
CVSS v3.0
7.5 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00585 · 47.2th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-09-16T12:16Z
References (2)
https://jvn.jp/en/jp/JVN45281119/ · [email protected]https://www.xikestor.com/security-advisory/ · [email protected]
EPSS history
Timeline
  • 17 SEP 03:33Z
    EPSS moved — → 1%
    epss
  • 16 SEP 07:29Z
    XikeStor Layer3 switches miss authentication for downloading configuration data
    cvelistv5