Access Control Vulnerability in Credentials Manager by Nozomi Networks
CVE-2026-33388

6.4MEDIUM

Key Information:

Vendor

Nozomi Networks

Status
Guardian
Cmc
Vendor
CVE Published:
8 September 2026

What is CVE-2026-33388?

An access control vulnerability in the Credentials Manager has been identified due to insufficient validation of user privileges. This allows a remote authenticated user with limited permissions to access a restricted view of available entries. While they cannot see the actual credential values, a malicious actor can delete entries or modify their properties. Such actions may disrupt authentication processes for associated devices, and through manipulation of entry configurations, attackers could potentially gain indirect access to sensitive credentials.

Affected Version(s)

CMC 0 < 26.3.0

Guardian 0 < 26.3.0

References

https://security.nozominetworks.com/NN-2026:19-01

CVSS V4

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This issue was found by Elia Battiston of Nozomi Networks during an internal investigation.
.