Nozomi Guardian CVE-2026-33923

Exploitation requires that the attacker already hold administrative privileges on the appliance (PR:H) and access to the update-installation functionality; the flaw is triggered specifically by supplying a crafted update bundle whose contents are validated inconsistently, so a signed bundle can carry an unsigned script that then executes as root at install time. The CVSS 4.0 AT:P indicates an additional attack requirement beyond a simple request, though the precise trigger condition beyond 'crafted bundle contents' is not further detailed in the available sources. Limiting factors: administrative authentication is mandatory (no unauthenticated path), and no user interaction is required (UI:N). Affected versions are Guardian and CMC below 26.4.0; both are fixed in 26.4.0.

This is a signature-verification bypass (CWE-347) in the update-installation path of Nozomi Networks Guardian and CMC appliances. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H) scores 7.5 (High) and tells a consistent story with the description: the attack is network-reachable (AV:N) but requires administrative privileges (PR:H) and an attack requirement (AT:P) - not a mass-exploitable, unauthenticated flaw. The high-privilege precondition is the decisive mitigating factor: the attacker must already be an administrator of the appliance, so this is primarily a privilege-escalation / integrity-and-trust-boundary break (admin → unsigned code as root) rather than a perimeter breach. No EPSS score is provided, this CVE is NOT on CISA KEV, and no proof-of-concept or exploit reference is present in the input - only the vendor advisory. The vendor/aggregator decision label is 'this_week', indicating prompt but not emergency remediation. Net: a legitimately High-severity integrity issue worth patching this week, but its real-world risk is bounded by the administrative-privilege requirement, and there is no evidence of active exploitation or public exploit code at the time of analysis.

An attacker who has already obtained administrative access to a Nozomi Guardian or CMC appliance (e.g., via stolen credentials or an insider) crafts a malicious update bundle that passes the appliance's signature check yet embeds an unsigned script. When the bundle is installed, the script executes with root privileges, letting the attacker read or alter sensitive data, change appliance configuration, or shut the appliance down. No public exploit identified at time of analysis.