CVE-2026-33920

CVE-2026-33920 affects the login functionality of Nozomi Networks Guardian/CMC (versions before 26.3.0 ). The root cause is a missing validation of the anti-CSRF token in both standard and SAML login flows. An attacker holding a valid account can coerce a victim into unknowingly authenticating wi...

CVE-2026-33920 Cross-site request forgery in the Guardian/CMC login before 26.3.0

A cross-site request forgery vulnerability was discovered in the login functionality both standard and SAML due to missing validation of the anti-CSRF token. An attacker with a valid account can trick a victim into unknowingly authenticating with the attacker's credentials. Any operation performe...

CVE-2026-33920 Cross-site request forgery in the Guardian/CMC login before 26.3.0

A cross-site request forgery vulnerability was discovered in the login functionality both standard and SAML due to missing validation of the anti-CSRF token. An attacker with a valid account can trick a victim into unknowingly authenticating with the attacker's credentials. Any operation performe...

CVE-2026-33391 Incorrect authorization in Smart Polling configuration in Guardian/CMC before 26.3.0

An access control vulnerability was discovered in the Smart Polling configuration functionality due to insufficient validation of user privileges. An authenticated user with limited privileges can remotely bypass the intended access control of the web management interface and modify the Smart...

CVE-2026-33391

Nozomi Networks Guardian/CMC contains an access control vulnerability in the Smart Polling configuration functionality, caused by insufficient validation of user privileges (incorrect authorization). An authenticated user with limited privileges can remotely bypass the web management interface's ...

CVE-2026-33391 Incorrect authorization in Smart Polling configuration in Guardian/CMC before 26.3.0

An access control vulnerability was discovered in the Smart Polling configuration functionality due to insufficient validation of user privileges. An authenticated user with limited privileges can remotely bypass the intended access control of the web management interface and modify the Smart...

CVE-2026-33389 Disabled and non-configurable certificate/host key validation in Smart Polling in Guardian/CMC before 26.3.0 and Arc before v2.7.0

An improper certificate/host key validation vulnerability was discovered in the Smart Polling functionality, which established encrypted connections to target devices without validating the remote host's identity, and no option was provided to enable it. A man-in-the-middle attacker positioned...

CVE-2026-33389 Disabled and non-configurable certificate/host key validation in Smart Polling in Guardian/CMC before 26.3.0 and Arc before v2.7.0

An improper certificate/host key validation vulnerability was discovered in the Smart Polling functionality, which established encrypted connections to target devices without validating the remote host's identity, and no option was provided to enable it. A man-in-the-middle attacker positioned...

CVE-2026-33389

An improper certificate/host key validation vulnerability exists in the Smart Polling functionality of Nozomi Networks Guardian/CMC (before 26.3.0 ) and Nozomi Networks Arc (before v2.7.0 ). Encrypted connections to polled devices were established without validating the remote host's identity, an...

CVE-2026-33388 Incorrect authorization in Credentials Manager in Guardian/CMC before 26.3.0

An access control vulnerability was discovered in the Credentials Manager functionality due to insufficient validation of user privileges. A remote authenticated user with limited privileges can view a limited subset of the available entries in the Credentials Manager. The actual credential value...

CVE-2026-33388

CVE-2026-33388 is an access control vulnerability in the Credentials Manager functionality of Nozomi Networks Guardian/CMC (affected: versions before 26.3.0 ). The root cause is insufficient validation of user privileges , allowing a remote authenticated user with limited privileges to view a sub...

CVE-2026-33388 Incorrect authorization in Credentials Manager in Guardian/CMC before 26.3.0

An access control vulnerability was discovered in the Credentials Manager functionality due to insufficient validation of user privileges. A remote authenticated user with limited privileges can view a limited subset of the available entries in the Credentials Manager. The actual credential value...

CVE-2026-33387 Insufficient sanitization of Dashboards in Guardian/CMC before 26.3.0

A template injection vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter. An authenticated user with the required privileges can define a dashboard containing a malicious payload, or a victim can be socially engineered into importing a...

CVE-2026-33387

A template injection vulnerability in the Dashboards functionality of Nozomi Networks Guardian/CMC (before 26.3.0 ) is caused by improper validation of an input parameter. An authenticated user with required privileges can define a dashboard containing a malicious payload, or a victim can be soci...

CVE-2026-33387 Insufficient sanitization of Dashboards in Guardian/CMC before 26.3.0

A template injection vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter. An authenticated user with the required privileges can define a dashboard containing a malicious payload, or a victim can be socially engineered into importing a...

Insufficient sanitization of Dashboards in Guardian/CMC before 26.3.0

Summary A template injection vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter. Impact An authenticated user with the required privileges can define a dashboard containing a malicious payload, or a victim can be socially engineered into...

Incorrect authorization in Smart Polling configuration in Guardian/CMC before 26.3.0

Summary An access control vulnerability was discovered in the Smart Polling configuration functionality due to insufficient validation of user privileges. Impact An authenticated user with limited privileges can remotely bypass the intended access control of the web management interface and modif...

Cross-site request forgery in the Guardian/CMC login before 26.3.0

Summary A cross-site request forgery vulnerability was discovered in the login functionality both standard and SAML due to missing validation of the anti-CSRF token. Impact An attacker with a valid account can trick a victim into unknowingly authenticating with the attacker's credentials. Any...

Incorrect authorization in Credentials Manager in Guardian/CMC before 26.3.0

Summary An access control vulnerability was discovered in the Credentials Manager functionality due to insufficient validation of user privileges. Impact A remote authenticated user with limited privileges can view a limited subset of the available entries in the Credentials Manager. The actual...

Disabled and non-configurable certificate/host key validation in Smart Polling in Guardian/CMC before 26.3.0 and Arc before v2.7.0

Summary An improper certificate/host key validation vulnerability was discovered in the Smart Polling functionality, which established encrypted connections to target devices without validating the remote host's identity, and no option was provided to enable it. Impact A man-in-the-middle attacke...