CVE-2026-33924 Authenticated RCE in update functionality in Guardian/CMC before 26.4.0

Two OS command injection vulnerabilities were discovered in the update installation functionality due to insufficient validation of the update bundle contents. An attacker with administrative privileges can remotely supply a crafted update bundle that, when installed, causes arbitrary commands to...

CVE-2026-33924

Two OS command injection vulnerabilities exist in the Guardian/CMC update installation functionality, affecting versions before 26.4.0 . The root cause is the insufficient validation of update bundle contents. An attacker with administrative privileges can remotely supply a crafted update bundle ...

CVE-2026-33924 Authenticated RCE in update functionality in Guardian/CMC before 26.4.0

Two OS command injection vulnerabilities were discovered in the update installation functionality due to insufficient validation of the update bundle contents. An attacker with administrative privileges can remotely supply a crafted update bundle that, when installed, causes arbitrary commands to...

CVE-2026-33923 Update bundle signature bypass in Guardian/CMC before 26.4.0

A signature verification vulnerability was discovered in the update installation functionality due to inconsistent validation of the update bundle contents. An attacker with administrative privileges can remotely supply a crafted update bundle that passes signature verification but runs an unsign...

CVE-2026-33923

A signature verification vulnerability exists in the update installation functionality of Guardian/CMC prior to version 26.4.0 . The root cause is the inconsistent validation of update bundle contents, allowing an attacker with administrative privileges to remotely supply a crafted bundle. While ...

CVE-2026-33923 Update bundle signature bypass in Guardian/CMC before 26.4.0

A signature verification vulnerability was discovered in the update installation functionality due to inconsistent validation of the update bundle contents. An attacker with administrative privileges can remotely supply a crafted update bundle that passes signature verification but runs an unsign...

Authenticated RCE in update functionality in Guardian/CMC before 26.4.0

Summary Two OS command injection vulnerabilities were discovered in the update installation functionality due to insufficient validation of the update bundle contents. Impact An attacker with administrative privileges can remotely supply a crafted update bundle that, when installed, causes...

Update bundle signature bypass in Guardian/CMC before 26.4.0

Summary A signature verification vulnerability was discovered in the update installation functionality due to inconsistent validation of the update bundle contents. Impact An attacker with administrative privileges can remotely supply a crafted update bundle that passes signature verification but...

CVE-2026-33920

CVE-2026-33920 affects the login functionality of Nozomi Networks Guardian/CMC (versions before 26.3.0 ). The root cause is a missing validation of the anti-CSRF token in both standard and SAML login flows. An attacker holding a valid account can coerce a victim into unknowingly authenticating wi...

CVE-2026-33920 Cross-site request forgery in the Guardian/CMC login before 26.3.0

A cross-site request forgery vulnerability was discovered in the login functionality both standard and SAML due to missing validation of the anti-CSRF token. An attacker with a valid account can trick a victim into unknowingly authenticating with the attacker's credentials. Any operation performe...

CVE-2026-33920 Cross-site request forgery in the Guardian/CMC login before 26.3.0

A cross-site request forgery vulnerability was discovered in the login functionality both standard and SAML due to missing validation of the anti-CSRF token. An attacker with a valid account can trick a victim into unknowingly authenticating with the attacker's credentials. Any operation performe...

CVE-2026-33391 Incorrect authorization in Smart Polling configuration in Guardian/CMC before 26.3.0

An access control vulnerability was discovered in the Smart Polling configuration functionality due to insufficient validation of user privileges. An authenticated user with limited privileges can remotely bypass the intended access control of the web management interface and modify the Smart...

CVE-2026-33391 Incorrect authorization in Smart Polling configuration in Guardian/CMC before 26.3.0

An access control vulnerability was discovered in the Smart Polling configuration functionality due to insufficient validation of user privileges. An authenticated user with limited privileges can remotely bypass the intended access control of the web management interface and modify the Smart...

CVE-2026-33391

Nozomi Networks Guardian/CMC contains an access control vulnerability in the Smart Polling configuration functionality, caused by insufficient validation of user privileges (incorrect authorization). An authenticated user with limited privileges can remotely bypass the web management interface's ...

CVE-2026-33389 Disabled and non-configurable certificate/host key validation in Smart Polling in Guardian/CMC before 26.3.0 and Arc before v2.7.0

An improper certificate/host key validation vulnerability was discovered in the Smart Polling functionality, which established encrypted connections to target devices without validating the remote host's identity, and no option was provided to enable it. A man-in-the-middle attacker positioned...

CVE-2026-33389 Disabled and non-configurable certificate/host key validation in Smart Polling in Guardian/CMC before 26.3.0 and Arc before v2.7.0

An improper certificate/host key validation vulnerability was discovered in the Smart Polling functionality, which established encrypted connections to target devices without validating the remote host's identity, and no option was provided to enable it. A man-in-the-middle attacker positioned...

CVE-2026-33389

An improper certificate/host key validation vulnerability exists in the Smart Polling functionality of Nozomi Networks Guardian/CMC (before 26.3.0 ) and Nozomi Networks Arc (before v2.7.0 ). Encrypted connections to polled devices were established without validating the remote host's identity, an...

CVE-2026-33388 Incorrect authorization in Credentials Manager in Guardian/CMC before 26.3.0

An access control vulnerability was discovered in the Credentials Manager functionality due to insufficient validation of user privileges. A remote authenticated user with limited privileges can view a limited subset of the available entries in the Credentials Manager. The actual credential value...

CVE-2026-33388

CVE-2026-33388 is an access control vulnerability in the Credentials Manager functionality of Nozomi Networks Guardian/CMC (affected: versions before 26.3.0 ). The root cause is insufficient validation of user privileges , allowing a remote authenticated user with limited privileges to view a sub...

CVE-2026-33388 Incorrect authorization in Credentials Manager in Guardian/CMC before 26.3.0

An access control vulnerability was discovered in the Credentials Manager functionality due to insufficient validation of user privileges. A remote authenticated user with limited privileges can view a limited subset of the available entries in the Credentials Manager. The actual credential value...