AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Nozomi NetworksCVE-2026-33390

An Incorrect Privilege Assignment vulnerability was discovered in the...

Nozomi Networks

CVE-2026-33390 · Published Jul 9, 2026 · updated Aug 11, 2026

High7.2
Fix: upgrade to Guardian 26.2.0 or later (2 fixed versions below)
Nozomi Networks advisory

An Incorrect Privilege Assignment vulnerability was discovered in the synchronization functionality due to Arc sensors receiving CLI permissions. An authenticated user with limited privileges can push administrative CLI commands through the sync, altering the device configuration, and/or affecting its availability.

Affected versions

PackageAffectedFixed in
CMC
Product
< 26.2.026.2.0
Guardian
Product
< 26.2.026.2.0
Details and references
CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-266

More Nozomi Networks advisories

All Nozomi Networks
Medium 4.8Aug 11Nozomi Networks Arc: insecure defaultCVE-2026-33921fixed in 2.7.0High 8.3Jul 9When the upstream Guardian or CMC was configured in the Remote Collector via...CVE-2026-31985fixed in 26.2.0Medium 4.8Jul 9Nozomi Networks Diagram tab: open redirectCVE-2026-31981fixed in Guardian 26.2.0 +1Medium 5.3Jul 9Nozomi Networks SAML Single Sign-On functionality: open redirectCVE-2026-31982fixed in Guardian 26.2.0 +1Medium 6.9Jul 9Nozomi Networks SSH keys synchronization endpoint: missing authenticationCVE-2026-31983fixed in Guardian 26.2.0 +1High 8.7Jul 9Nozomi Networks CMC: denial of serviceCVE-2026-31984fixed in Guardian 26.2.0 +1