Which versions of Nozomi Remote Collector are affected by CVE-2026-31985?

Nozomi Networks Remote Collector contains a man-in-the-middle vulnerability (CVSS 8.3) where upstream Guardian or CMC configuration automatically disables TLS certificate verification, eliminating a…. A patch is available.

How to fix or mitigate CVE-2026-31985?

Within 24 hours: Audit all Nozomi Remote Collector deployments; identify instances configured with Guardian or CMC upstreams; document network topology and access points between collectors and upstream systems. Within 7 days: Implement continuous network monitoring (packet inspection, anomaly detection) on all collector-to-Guardian/CMC traffic; enable audit logging for all collector configuration changes and sync activity; review historical logs for indicators of compromise. Within 30 days: Subscribe to Nozomi security advisories for patch release notifications; evaluate interim architecture changes (air-gapped collectors, network micro-segmentation, or alternative monitoring products) if patch timeline exceeds organizational risk tolerance.

Nozomi Remote Collector CVE-2026-31985

Q: What is the CVSS score of CVE-2026-31985?

CVE-2026-31985 has a CVSS 4.0 base score of 8.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-42535 HIGH

Lack of Administrator Control over Security (CWE-671)

2026-07-09 Nozomi

GHSA-r8ph-vcp7-p3mx

Code Injection Remote Collector Nozomi Networks

8.3

CVSS 4.0 · Vendor: Nozomi

Severity by source

Vendor (Nozomi) PRIMARY

8.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.0 HIGH

AC:H because a man-in-the-middle position must be established; PR:N/UI:N as no Collector auth or user action is needed; impact is integrity-dominant (I:H) from data injection with lower C/A.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:N

Primary rating from Vendor (Nozomi).

CVSS VectorVendor: Nozomi

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 09, 2026 - 09:02 EUVD

Analysis Generated

Jul 09, 2026 - 08:35 vuln.today

DescriptionCVE.org

When the upstream Guardian or CMC was configured in the Remote Collector via n2os-tui, the generated configuration disabled TLS certificate verification, and no option was provided to enable it. A malicious actor could perform a man-in-the-middle attack and intercept the communication between the Remote Collector and the Guardian or CMC. This could result in theft of the sync token, impersonation of the server, injection of spoofed data (such as false asset information or vulnerabilities) into the Guardian or CMC, or disruption of the data flow between the Remote Collector and the Guardian or CMC.

AnalysisAI

Man-in-the-middle exposure in Nozomi Networks Remote Collector arises because configuring an upstream Guardian or CMC through the n2os-tui interface generates a configuration that disables TLS certificate verification, with no option to re-enable it. Any attacker positioned on the network path between the Remote Collector and its Guardian/CMC can intercept the channel to steal the sync token, impersonate the server, inject spoofed asset or vulnerability data, or disrupt telemetry flow. There is no public exploit identified at time of analysis, and the issue is not on CISA KEV; the vendor (Nozomi) self-reported it.

Technical ContextAI

The Remote Collector aggregates OT/IoT/ICS telemetry and forwards it to a central Guardian sensor or the Central Management Console (CMC) over a network link that is expected to be TLS-protected. The root cause maps to CWE-671 (Lack of Administrator Control over Security), because the n2os-tui setup workflow bakes in a configuration that turns off certificate validation and exposes no toggle for an operator to enforce it - so trust in the server's identity is silently removed. Without certificate verification, the TLS handshake still encrypts data but cannot authenticate the peer, defeating the anti-tampering and anti-impersonation guarantees TLS is meant to provide. The affected component is identified in CPE as cpe:2.3:a:nozomi_networks:remote_collector, an appliance-class product used in industrial/critical-infrastructure network monitoring.

RemediationAI

Consult the Nozomi advisory at https://security.nozominetworks.com/NN-2026:12-01 and apply the vendor-provided fixed n2os release once its version is confirmed there; no exact fix version is included in the provided data, so treat the advisory as authoritative for the patched build. As a compensating control until patched, place the Remote Collector and its upstream Guardian/CMC on a dedicated, physically or logically isolated management network (or an IPsec/VPN tunnel) so an attacker cannot occupy the on-path MitM position the flaw requires - the trade-off is added network engineering and no protection if the management segment itself is compromised. Additionally, rotate the sync token after patching in case it was exposed, and monitor for anomalous or duplicate asset/vulnerability records that could indicate injected spoofed data. Avoid re-running the n2os-tui Guardian/CMC configuration on unpatched systems, since that is what generates the insecure, verification-disabled configuration.