Nozomi Networks Arc CVE-2026-33922

Exploitation requires two concurrent conditions: (1) local access to the host running Nozomi Networks Arc's web interface, and (2) valid administrative credentials for that web interface. The vulnerable functionality is specifically the 'Offline archives' feature - the archive name input field is the attack surface. The Arc process must be running with administrative privileges on the host (described as the default deployment mode). Factors limiting exploitation: the attacker cannot be remote (AV:L), unauthenticated exploitation is not possible (PR:H per CVSS 4.0), and the impact is restricted to file deletion (no confidentiality impact - VC:N in CVSS 4.0). Non-administrative Arc web interface accounts are not affected.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:H/UI:N) accurately characterizes this as a local, low-complexity attack requiring high administrative privileges - the score of 6.8 is a reasonable reflection of the constrained attack surface. Real-world risk is moderate: an attacker must already hold administrative credentials for the Arc web interface and have local access, which represents a significant barrier. However, the destructive potential - arbitrary file deletion by a process with host admin privileges - is disproportionately severe once those prerequisites are met, meaning even a mid-sized municipal IT team in inowroclaw operating an Arc deployment for OT visibility should treat this as a priority patch rather than a deferred medium. No EPSS data was provided, and the absence of KEV status and public POC code aligns with a low likelihood of opportunistic exploitation; the primary threat model is a malicious or compromised insider with admin access. No conflicting signals exist between the CVSS vector and the description - both consistently indicate local, authenticated access.

An insider or attacker who has obtained administrative credentials for the Arc local web interface submits an archive name containing traversal sequences (e.g., '../../../../var/log/arc/') to the Offline archives function. The Arc process, running with host administrative privileges, interprets the traversal and deletes the targeted path, potentially removing configuration files, log archives, or critical OS files, causing service disruption or covering attacker tracks. No public POC exists at time of analysis.