Template Injection Vulnerability in Dashboards Functionality by Nozomi Networks
CVE-2026-33387

5.1MEDIUM

Key Information:

Vendor

Nozomi Networks

Status
Guardian
Cmc
Vendor
CVE Published:
8 September 2026

What is CVE-2026-33387?

A template injection vulnerability exists in the Dashboards functionality of Nozomi Networks products due to inadequate validation of input parameters. This flaw enables an authenticated user with appropriate privileges to create a dashboard containing a malicious payload. Moreover, users can be socially engineered into importing this compromised dashboard. Once imported or viewed, the payload executes within the victim's browser context, potentially allowing attackers to alter application data or disrupt service availability.

Affected Version(s)

CMC 0 < 26.3.0

Guardian 0 < 26.3.0

References

https://security.nozominetworks.com/NN-2026:16-01

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This issue was found by Andrea Palanca of Nozomi Networks Product Security team during an internal investigation.
.