Vulnerability · Published Sep 8, 2026 · Assigned by Nozomi

CVE-2026-33387Insufficient sanitization of Dashboards in Guardian/CMC before 26.3.0

Medium 4.6

In plain English

A medium-severity security flaw in CMC from Nozomi Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 3.1)4.6Medium

Exploit odds (30 days)0.3%top 82.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A template injection vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter. An authenticated user with the required privileges can define a dashboard containing a malicious payload, or a victim can be socially engineered into importing a malicious dashboard. When the victim views or imports the dashboard, the payload executes in their browser context, allowing the attacker to modify application data or disrupt application availability.

Affected products (as reported)

Vendor	Product	Versions
Nozomi Networks	Guardian	0 – before 26.3.0
Nozomi Networks	CMC	0 – before 26.3.0

Weakness: CWE-1336 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

In plain English

Official description

Affected products (as reported)

References