Vulnerability · Published Apr 15, 2026 · Assigned by Nozomi

CVE-2025-40897Incorrect authorization for Threat Intelligence in Guardian/CMC before 26.0.0

High 8.1

In plain English

A high-severity incorrect authorization in CMC from Nozomi Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.3%top 74.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An access control vulnerability was discovered in the Threat Intelligence functionality due to a specific access restriction not being properly enforced for users with view-only privileges. An authenticated user with view-only privileges for the Threat Intelligence functionality can perform administrative actions on it, altering the rules configuration, and/or affecting their availability.

Affected products (as reported)

Vendor	Product	Versions
Nozomi Networks	Guardian	0 – before 26.0.0
Nozomi Networks	CMC	0 – before 26.0.0

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

In plain English

Official description

Affected products (as reported)

References