IXP Manager: Privilege escalation to administrator

Summary

IXP Manager, a web application for operating Internet Exchange Points, allows an authenticated non-administrative user to elevate their privileges to administrator status. An attacker who holds any valid low-privilege account, for example a member or customer account on an internet-facing instance, can exploit this over the network without user interaction. The CVSS 3.1 base score is 8.8 (High). Restricting administrative functions reduces exposure but is not a complete fix.

Affected

• IXP Manager versions prior to 7.3.0
• Unknown: whether intermediate builds or deployments with custom configurations are affected in a different way

Fixed in

• Upgrade to IXP Manager 7.3.0 or a later supported release
• Apply the official upgrade instructions, including database migrations

Workaround

• No vendor-documented workaround available.
• Restricting administrative functions reduces exposure but does not fix the vulnerability (see vendor's Securing Administrative Functions documentation).

Exploitation

• No evidence of active exploitation known at the time of writing.
• Not listed in CISA KEV; no public proof-of-concept confirmed.
• Status may change; recheck the GitHub advisory.

Our recommendation

• Identify all IXP Manager instances and confirm their version.
• Upgrade to 7.3.0 or a later supported 7.x release, together with the fix for CVE-2026-63338.
• Review existing non-administrative accounts and their permissions, and check for unexpected administrator accounts.
• Restrict who can create accounts and monitor for new administrator accounts.
• If no IXP Manager is in use, no action needed.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• IXP Manager Release v7.3.0 github.com
• GHSA-f5xv-q6fj-hfrc Security Advisory github.com
• VulDB CVE-2026-63339 vuldb.com
• Strix CVE-2026-63339 www.strix.ai
• IXP Manager Security Overview github.com
• IXP Manager Security Documentation docs.ixpmanager.org

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 08:37.