CVEvulnerability

CVE-2026-33390

7.2 HIGH Published 2026-07-09 Modified 2026-08-11 Official page ↗
Status
Modified
Published
2026-07-09
Last modified
2026-08-11
Assigner
[email protected]
CVSS 4.0 ([email protected])
7.2 HIGH — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1 ([email protected])
8.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Weaknesses
CWE-266

Description

An Incorrect Privilege Assignment vulnerability was discovered in the synchronization functionality due to Arc sensors receiving CLI permissions. An authenticated user with limited privileges can push administrative CLI commands through the sync, altering the device configuration, and/or affecting its availability.

Affected configurations

• nozominetworks cmc (< 26.2.0) • nozominetworks guardian (< 26.2.0)

Related

Weakness · CWE (1)

  • CWE-266 Incorrect Privilege Assignment weakness

References