Server Certificate Verification Flaw in Arc Agent Affecting Guardian or CMC

CVE-2025-40896

What is CVE-2025-40896?

A significant flaw exists in the Arc agent's server certificate validation process when connecting to the Guardian or CMC, allowing a malicious actor to potentially conduct a man-in-the-middle attack. This vulnerability can enable the interception of sensitive communication between the Arc agent and the Guardian or CMC. Attackers could hijack client tokens and gain access to private data, which may include asset details and alerts. Furthermore, there is a risk of server impersonation, leading to the injection of misleading information into the system, such as fraudulent asset data or erroneous vulnerability reporting.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References