Vulnerability · Published Sep 8, 2026 · Assigned by Nozomi

CVE-2026-33391Incorrect authorization in Smart Polling configuration in Guardian/CMC before 26.3.0

Medium 5.4

In plain English

A medium-severity incorrect authorization in CMC from Nozomi Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.4%top 70.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An access control vulnerability was discovered in the Smart Polling configuration functionality due to insufficient validation of user privileges. An authenticated user with limited privileges can remotely bypass the intended access control of the web management interface and modify the Smart Polling discovery configuration. This allows the attacker to disrupt the visibility of assets in the monitored network.

Affected products (as reported)

Vendor	Product	Versions
Nozomi Networks	Guardian	0 – before 26.3.0
Nozomi Networks	CMC	0 – before 26.3.0

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

In plain English

Official description

Affected products (as reported)

References