What’s Vulnerable › Products
Nozomi Networks CMC vulnerabilities
51 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 36 published in the last 12 months.
Check whether your Nozomi Networks CMC version is affected
Latest Nozomi Networks CMC vulnerabilities
- CVE-2026-33924 — Authenticated RCE in update functionality in Guardian/CMC before 26.4.0 (CVSS 7.2)
- CVE-2026-33923 — Update bundle signature bypass in Guardian/CMC before 26.4.0 (CVSS 7.2)
- CVE-2026-33920 — Cross-site request forgery in the Guardian/CMC login before 26.3.0 (CVSS 3.5)
- CVE-2026-33391 — Incorrect authorization in Smart Polling configuration in Guardian/CMC before 26.3.0 (CVSS 5.4)
- CVE-2026-33389 — Disabled and non-configurable certificate/host key validation in Smart Polling in Guardian/CMC before 26.3.0 and Arc before v2.7.0 (CVSS 7.5)
- CVE-2026-33388 — Incorrect authorization in Credentials Manager in Guardian/CMC before 26.3.0 (CVSS 7.4)
- CVE-2026-33387 — Insufficient sanitization of Dashboards in Guardian/CMC before 26.3.0 (CVSS 4.6)
- CVE-2026-33390 — Incorrect privilege assignment for Arc sensors in Guardian/CMC before 26.2.0 (CVSS 8.1)
- CVE-2026-31984 — DoS through oversized audit log entries in Guardian/CMC before 26.2.0 (CVSS 7.5)
- CVE-2026-31983 — Missing authentication in SSH keys synchronization endpoint in Guardian/CMC before 26.2.0 (CVSS 5.3)
- CVE-2026-31982 — Open Redirect in SAML Single Sign-On in Guardian/CMC before 26.2.0 (CVSS 7.1)
- CVE-2026-31981 — HTML injection in Diagram tab and Graph view in Guardian/CMC before 26.2.0 (CVSS 4.8)
- CVE-2025-40904 — HTML injection in Smart Polling in Guardian/CMC before 26.1.0 (CVSS 5.4)
- CVE-2025-40903 — HTML injection in Schedule Restore Archive in Guardian/CMC before 26.1.0 (CVSS 4.8)
- CVE-2025-40902 — HTML injection in Users in Guardian/CMC before 26.1.0 (CVSS 4.8)
- CVE-2025-40901 — HTML injection in Credentials Manager in Guardian/CMC before 26.1.0 (CVSS 4.8)
- CVE-2025-40900 — Angular template injection in Reports in Guardian/CMC before 26.1.0 (CVSS 4.6)
- CVE-2025-40899 — Stored Cross-Site Scripting (XSS) in Assets and Nodes in Guardian/CMC before 26.0.0 (CVSS 8.9)
- CVE-2025-40897 — Incorrect authorization for Threat Intelligence in Guardian/CMC before 26.0.0 (CVSS 8.1)
- CVE-2025-40895 — HTML injection in Sensor Map in CMC before 25.6.0 (CVSS 4.8)
- CVE-2025-40894 — HTML injection in Alerted Nodes Dashboard in Guardian/CMC before 25.6.0 (CVSS 5.4)
- CVE-2025-40898 — Path traversal in Import Arc data archive functionality in Guardian/CMC before 25.5.0 (CVSS 8.1)
- CVE-2025-40893 — HTML injection in Asset List in Guardian/CMC before 25.5.0 (CVSS 6.1)
- CVE-2025-40892 — Stored Cross-Site Scripting (XSS) in Reports in Guardian/CMC before 25.5.0 (CVSS 8.9)
- CVE-2025-40891 — HTML injection in in Time Machine functionality in Guardian/CMC before 25.5.0 (CVSS 4.7)