CVE-2026-33389: Disabled and non-configurable certificate/host key validation in Smart Polling in Guardian/CMC before 26.3.0 and Arc before v2.7.0

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-08 · updated 2026-10-15
Weakness: CWE-671

Description

An improper certificate/host key validation vulnerability was discovered in the Smart Polling functionality, which established encrypted connections to target devices without validating the remote host's identity, and no option was provided to enable it. A man-in-the-middle attacker positioned between a sensor and a polled device can, during a polling session, impersonate the device and intercept the communication, including the credentials used to access it. The captured credentials can then be replayed to authenticate against the device itself or against other devices sharing the same credentials, allowing the attacker to access and tamper with the device's data and to disrupt its operations.

Affected products

Nozomi Networks Arc: before 2.7.0 — fixed in 2.7.0
Nozomi Networks CMC: before 26.3.0 — fixed in 26.3.0
Nozomi Networks Guardian: before 26.3.0 — fixed in 26.3.0

How to fix

Upgrade to a fixed version: Nozomi Networks Arc 2.7.0; Nozomi Networks CMC 26.3.0; Nozomi Networks Guardian 26.3.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-33389 or the next vulnerability affects your stack