What’s Vulnerable › Vulnerabilities

CVE-2025-40899: Stored Cross-Site Scripting (XSS) in Assets and Nodes in Guardian/CMC before 26.0.0

• Severity: high (CVSS 8.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-15 · updated 2026-10-14
• Weakness: CWE-79

Description

A Stored Cross-Site Scripting vulnerability was discovered in the Assets and Nodes functionality due to improper validation of an input parameter. An authenticated user with custom fields privileges can define a malicious custom field containing a JavaScript payload. When the victim views the Assets or Nodes pages, the XSS executes in their browser context, allowing the attacker to perform unauthorized actions as the victim, such as modify application data, disrupt application availability, and access limited sensitive information.

Affected products

• Nozomi Networks CMC: before 26.0.0 — fixed in 26.0.0
• Nozomi Networks Guardian: before 26.0.0 — fixed in 26.0.0

How to fix

Upgrade to a fixed version: Nozomi Networks CMC 26.0.0; Nozomi Networks Guardian 26.0.0. Check the vendor advisory for mitigations.

References

• https://security.nozominetworks.com/NN-2026:2-01
• https://cert-portal.siemens.com/productcert/html/ssa-827968.html

Get alerted when CVE-2025-40899 or the next vulnerability affects your stack