Vulnerability · Published Sep 8, 2026 · Assigned by Nozomi

CVE-2026-33920Cross-site request forgery in the Guardian/CMC login before 26.3.0

Low 3.5

In plain English

A low-severity cross-site request forgery in CMC from Nozomi Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).

Severity (CVSS 3.1)3.5Low

Exploit odds (30 days)0.1%top 96.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A cross-site request forgery vulnerability was discovered in the login functionality (both standard and SAML) due to missing validation of the anti-CSRF token. An attacker with a valid account can trick a victim into unknowingly authenticating with the attacker's credentials. Any operation performed by the victim in this state is attributed to the attacker's account, compromising the integrity of the audit trail.

Affected products (as reported)

Vendor	Product	Versions
Nozomi Networks	Guardian	0 – before 26.3.0
Nozomi Networks	CMC	0 – before 26.3.0

Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

In plain English

Official description

Affected products (as reported)

References