Nozomi Arc CVE-2026-33921

Exploitation requires an active non-privileged (standard user) local Windows session on a host where Nozomi Arc was installed using the vulnerable installer. The critical enabling condition is that Npcap must have been deployed without the admin-only access restriction - this is the insecure default produced by the Arc installer and requires no deliberate misconfiguration by an administrator. No special network position, remote connectivity, or additional software beyond the already-installed Npcap driver is required. Exploitation is bounded by the need for a local user account and physical or remote desktop access to the specific Arc-hosting Windows machine; remote network-only access is insufficient. Systems where Npcap's admin-only registry key was manually set post-installation, or environments where all local accounts hold administrator privileges, are not exploitable under this issue.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N) scores 4.8 Medium, accurately capturing that exploitation demands an authenticated local session and yields limited rather than total confidentiality or integrity compromise. EPSS data was not provided in source intelligence; given the local-only attack vector and specialized deployment context, opportunistic mass exploitation is unlikely. The vulnerability is not listed in the CISA KEV catalog and no public POC is known. Risk is contextually elevated in OT/ICS environments - Arc's primary market - where network traffic frequently carries unencrypted industrial protocols such as Modbus TCP, DNP3, and EtherNet/IP, meaning partial traffic capture can expose highly sensitive operational data, setpoints, or ladder logic. The packet injection capability additionally introduces network-layer spoofing or disruption of industrial devices. Shared-workstation and kiosk deployments common in industrial control rooms increase the probability that a non-admin user is present. The raw CVSS score represents the technical floor; real-world priority in OT contexts is meaningfully higher.

A standard Windows domain user with a local session on an Arc-hosting workstation installs a legitimate packet capture utility such as Wireshark, which leverages the already-deployed and unrestricted Npcap driver without requiring administrator rights or UAC elevation. The user passively captures unencrypted Modbus TCP or DNP3 traffic flowing through the host, extracting PLC register values, device addresses, or engineering credentials in plaintext. Using the same Npcap raw-socket access, the attacker subsequently crafts and injects spoofed industrial protocol packets to manipulate a PLC setpoint or disrupt communication on the OT network segment. No public POC specific to this misconfiguration is known; standard Npcap-based tooling is sufficient.