EUVD-2026-55996
GHSA-28gp-jr6q-rxgq
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local access and high-privilege web admin credentials required; file deletion causes integrity and availability impact; no confidentiality breach and scope unchanged.
Primary rating from Vendor (Nozomi).
CVSS VectorVendor: Nozomi
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
A path traversal vulnerability was discovered in the Offline archives functionality of the local web interface due to insufficient validation of an input parameter. A local user with administrative credentials for the web interface could submit an archive name containing traversal sequences and delete arbitrary files reachable by the Arc process, which runs with administrative privileges on the host.
AnalysisAI
Path traversal in Nozomi Networks Arc's local web interface allows a local administrator to delete arbitrary files on the host system by submitting a crafted archive name containing directory traversal sequences to the Offline archives functionality. The Arc process executes with administrative privileges on the host, meaning the deletable file scope extends well beyond the web interface's normal reach. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two concurrent conditions: (1) local access to the host running Nozomi Networks Arc's web interface, and (2) valid administrative credentials for that web interface. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:H/UI:N) accurately characterizes this as a local, low-complexity attack requiring high administrative privileges - the score of 6.8 is a reasonable reflection of the constrained attack surface. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An insider or attacker who has obtained administrative credentials for the Arc local web interface submits an archive name containing traversal sequences (e.g., '../../../../var/log/arc/') to the Offline archives function. The Arc process, running with host administrative privileges, interprets the traversal and deletes the targeted path, potentially removing configuration files, log archives, or critical OS files, causing service disruption or covering attacker tracks. … |
| Remediation | Consult the Nozomi Networks advisory NN-2026:15-01 at https://security.nozominetworks.com/NN-2026:15-01 for the patched release version - the provided data does not specify an exact fix version, so a specific upgrade target cannot be independently confirmed here. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
CData RSB Connect v22.0.8336 was discovered to contain a Server-Side Request Forgery (SSRF). Rated high severity (CVSS 7
Arc before 1.26.1 on Windows has a bypass issue in the site settings that allows websites (with previously granted permi
The server certificate was not verified when an Arc agent connected to a Guardian or CMC. A malicious actor could perfor
Nozomi Networks Arc for Windows installs the Npcap packet capture driver with its access restriction option left at the
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today