OS Command Injection Vulnerabilities in Nozomi Networks' Update Installation
CVE-2026-33924

7.5HIGH

Key Information:

Vendor

Nozomi Networks

Status
Guardian
Cmc
Vendor
CVE Published:
29 October 2026

What is CVE-2026-33924?

Two vulnerabilities in Nozomi Networks' update installation process allow an attacker with administrative privileges to supply a malicious update bundle. This insufficient validation leads to arbitrary command execution with root privileges, potentially enabling the attacker to access, alter sensitive data, modify system configurations, or even disable the appliance.

Affected Version(s)

CMC 0 < 26.4.0

Guardian 0 < 26.4.0

References

https://security.nozominetworks.com/NN-2026:22-01

CVSS V4

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This issue was found by Guglielmo Fachini of Nozomi Networks and Andrea Palanca of Nozomi Networks Product Security team during an internal investigation.
.