Nozomi Guardian EUVD-2026-72761

Exploitation requires an authenticated account on the Nozomi Networks Guardian or CMC platform with at least low-level dashboard creation or management privileges (CVSS PR:L). The description notes 'required privileges' for dashboard definition, which may mean a specific dashboard-editor role rather than any authenticated user - this is not fully disambiguated in available data. A second prerequisite is victim interaction: a privileged user must either browse to the malicious dashboard or be socially engineered into importing a dashboard file from an untrusted source (CVSS UI:P). Exploitation is constrained to confidentiality-neutral impact (no credential or data exfiltration confirmed); consequences are limited to application data modification and availability disruption within the monitoring platform. Default installations without custom privilege separation may grant all authenticated users dashboard creation rights, broadening the attacker pool.

The CVSS 4.0 score of 5.1 (Medium) accurately reflects the constrained impact: exploitation requires an authenticated low-privilege account (PR:L) and passive victim interaction (UI:P), and there is no confidentiality impact (VC:N) - only limited integrity (VI:L) and availability (VA:L) consequences. The attack is fully network-accessible (AV:N, AC:L, AT:N), meaning no special network position is required. In context, however, these products sit at the heart of OT security monitoring operations; even limited data modification or availability disruption in a SOC or ICS environment can impair situational awareness during an incident. No EPSS score was provided. No POC is publicly known and the vulnerability is not in CISA KEV, placing real-world exploitation risk as low-to-moderate at this time. The social-engineering import path represents a realistic secondary vector if email-based dashboard sharing is common in target organizations.

An attacker with a low-privilege Guardian or CMC account creates a dashboard that embeds a malicious template expression in an insufficiently validated input parameter. The attacker then shares the dashboard export file with a higher-privileged analyst via a phishing email or internal file share, convincing them to import it. Upon viewing the imported dashboard, the template engine evaluates the payload in the analyst's browser session, modifying monitoring configurations or generating disruptive UI errors that impair incident response.