Nozomi Guardian CVE-2026-33924

Exploitation requires the attacker to already hold administrative privileges on a Nozomi Networks Guardian or CMC appliance (PR:H) and to be able to submit a crafted update bundle through the appliance's update installation functionality; the injected OS commands then run as root because the bundle contents are insufficiently validated. Limiting factors: valid administrative authentication is mandatory, so this is not reachable by unauthenticated users; it affects CMC and Guardian versions before 26.4.0; and the vendor's AT:P metric signals an additional attack requirement whose nature is not described in the available sources. No end-user interaction is required (UI:N).

Signals are mixed and point to a real but bounded priority. The CVSS 4.0 base score of 7.5 (High) is driven by full root-level code execution (VC:H/VI:H/VA:H) over a network vector (AV:N/AC:L/UI:N), but the critical limiting metric is PR:H - the attacker must already hold administrative privileges on the appliance, so this is effectively a privilege-escalation from appliance-admin to underlying OS root rather than an unauthenticated remote compromise. No EPSS score was supplied, the CVE is not listed in CISA KEV, and no public exploit was identified, so there is no evidence of widespread or active exploitation. The vendor's vuln.today decision label is 'this_week' and a patch is available, indicating prompt but non-emergency remediation. The vendor vector includes AT:P (an attack requirement), but the available sources do not describe what that requirement is, so the practical difficulty of triggering the flaw cannot be confirmed from the data. Overall this is a genuine high-impact issue gated behind strong pre-conditions (trusted admin access) rather than a mass-exploitable critical.

An attacker who has already obtained administrative credentials to a Nozomi Networks Guardian or CMC appliance crafts a malicious update bundle and installs it through the update functionality; insufficient validation of the bundle contents causes injected OS commands to execute with root privileges, letting the attacker read or modify sensitive data, alter appliance configuration, or shut the appliance down. No public exploit was identified at time of analysis, and exploitation requires existing administrative access (PR:H).