Nozomi Guardian CVE-2026-31981

Exploitation requires an authenticated session with administrative privileges on Nozomi Networks Guardian or CMC - this is a PR:H condition confirmed by the CVSS 4.0 vector. The injected HTML must be stored in N2OS configuration data fields that are subsequently rendered in the Diagram tab or Graph view; exploitation does not occur unless a victim user navigates to those specific views (UI:P). Full XSS (script execution) is explicitly prevented by the deployed Content Security Policy and existing input validation layer, meaning exploitation is limited to HTML rendering effects such as phishing links and open redirects. Exploitation is further limited to network-accessible deployments where the web UI is reachable (AV:N). No special non-default configuration is required beyond the product's normal deployment, but the requirement for admin-level write access to configuration data is a significant real-world barrier.

Real-world risk here is modest and bounded by multiple architectural mitigations already in place. The CVSS 4.0 score of 4.8 (Medium) and vector (AV:N/AC:L/AT:N/PR:H/UI:P) accurately reflects the key limiting factors: exploitation requires an already-authenticated user with administrative privileges (PR:H), and impact is only realized when another user passively views the affected Diagram or Graph page (UI:P). The attacker must already hold admin-level access to inject data - this is not a privilege escalation path, and the attack does not expand attacker capabilities within the system itself. EPSS data is not present in the provided input, so statistical exploitation probability cannot be cited. There is no CISA KEV listing and no known public exploit or POC. The vendor (Nozomi Networks) self-disclosed this vulnerability, which is a positive signal for remediation readiness but means independent third-party validation of scope is limited. The impact metrics (VC:L/VI:L/VA:L on the vulnerable system; SC:L/SI:L/SA:L on subsequent systems) are consistent with a phishing or open-redirect scenario against other users' browser sessions rather than direct data compromise. The CSP and existing validation serve as meaningful defense-in-depth, preventing this from escalating to full XSS. Priority for remediation should be moderate - relevant especially for environments where multiple admin-level users share access to Guardian/CMC, creating a plausible scenario for intra-admin social engineering.

An attacker who has obtained administrative credentials to Nozomi Networks Guardian or CMC (through credential theft, insider access, or lateral movement within a management network) injects a crafted HTML anchor or iframe tag into N2OS configuration data fields processed by the shared validation function. When a second administrator or operator opens the Diagram tab or Graph view, the injected HTML renders in their browser, presenting a convincing phishing link or silently redirecting them to an attacker-controlled domain to harvest further credentials. No public proof-of-concept code has been identified at time of analysis, and the attack is constrained to social engineering outcomes rather than direct code execution.