Skip to main content

Nozomi Arc EUVDEUVD-2026-55995

| CVE-2026-33921 MEDIUM
Initialization of a Resource with an Insecure Default (CWE-1188)
2026-08-11 Nozomi GHSA-gwvc-2mf6-9jv4
Information Disclosure Microsoft Arc Red Hat
4.8
CVSS 4.0 · Vendor: Nozomi
Share

Severity by source

Vendor (Nozomi) PRIMARY
4.8 MEDIUM
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.2 MEDIUM

Local non-admin session required (AV:L/PR:L); scope changes to adjacent hosts via traffic capture and packet injection (S:C/C:L/I:L); no availability impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Red Hat
5.2 MEDIUM
qualitative

Primary rating from Vendor (Nozomi).

CVSS VectorVendor: Nozomi

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

2
Patch available
Aug 11, 2026 - 11:02 EUVD
Analysis Generated
Aug 11, 2026 - 10:21 vuln.today

DescriptionCVE.org

The Windows installer deployed Npcap leaving its access restriction option at the insecure default value, so the driver was accessible to every local user of the host instead of being restricted to administrators only. A local user without administrative privileges could use the Npcap driver to capture the traffic reaching the host, which discloses information belonging both to the host and to other systems on the same network segment, and to send arbitrary raw packets on that segment.

AnalysisAI

Nozomi Networks Arc for Windows installs the Npcap packet capture driver with its access restriction option left at the insecure default, making the driver accessible to all local users rather than administrators only. Any non-privileged local user on an affected host can leverage this misconfiguration to capture network traffic traversing the host's interfaces - exposing data from both the local system and peer hosts on the same network segment - and to inject arbitrary raw packets onto that segment. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain local non-admin Windows session
Delivery
Access unrestricted Npcap driver (insecure default)
Exploit
Open raw packet capture on network interface
Execution
Exfiltrate plaintext OT/IT traffic from network segment
Impact
Inject crafted raw packets onto segment
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires an active non-privileged (standard user) local Windows session on a host where Nozomi Arc was installed using the vulnerable installer. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N) scores 4.8 Medium, accurately capturing that exploitation demands an authenticated local session and yields limited rather than total confidentiality or integrity compromise. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario A standard Windows domain user with a local session on an Arc-hosting workstation installs a legitimate packet capture utility such as Wireshark, which leverages the already-deployed and unrestricted Npcap driver without requiring administrator rights or UAC elevation. The user passively captures unencrypted Modbus TCP or DNP3 traffic flowing through the host, extracting PLC register values, device addresses, or engineering credentials in plaintext. …
Remediation The primary remediation is to deploy a corrected Nozomi Arc Windows installer that enables Npcap's administrator-only access restriction at installation time; consult the vendor advisory at https://security.nozominetworks.com/NN-2026:14-01 for the specific patched installer version, which was not independently confirmed from available data. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Arc

View all
CVE-2023-24243 HIGH POC
7.5 Jun 16

CData RSB Connect v22.0.8336 was discovered to contain a Server-Side Request Forgery (SSRF). Rated high severity (CVSS 7
CVE-2024-52928 CRITICAL
9.6 Jun 26

Arc before 1.26.1 on Windows has a bypass issue in the site settings that allows websites (with previously granted permi
CVE-2026-33922 MEDIUM
6.8 Aug 11

Path traversal in Nozomi Networks Arc's local web interface allows a local administrator to delete arbitrary files on th
CVE-2025-40896 MEDIUM
6.5 Mar 04

The server certificate was not verified when an Arc agent connected to a Guardian or CMC. A malicious actor could perfor

Same weakness CWE-1188 – Initialization of a Resource with an Insecure Default

View all
CVE-2017-4971 MEDIUM
5.9
CVE-2023-27524 CRITICAL POC
9.8
CVE-2022-24706 CRITICAL POC
9.8
CVE-2017-7964 CRITICAL POC
10.0
CVE-2017-8218 CRITICAL POC
9.8
CVE-2026-28775 CRITICAL POC
9.8
CVE-2026-66066 CRITICAL POC
9.5
CVE-2025-70998 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

Share

EUVD-2026-55995 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy