Arc
Monthly
Address bar spoofing in Arc Browser lets remote, unauthenticated attackers paint a convincing fake address bar over the genuine browser chrome by embedding a <select> element on an attacker-controlled page that invokes the Fullscreen API; because Arc fails to display the expected fullscreen notification, the victim never gets the visual cue that would normally reveal the browser is in a special display state. Exploitation is gated on user interaction - the victim must open the malicious page and engage with the select element - and the outcome is deception/phishing rather than code execution or direct data access, which is why the authoritative assessment lowers the integrity impact to I:L instead of the I:H in the widely-cited 7.4 vector. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Missing application-layer authentication in Arc Enterprise's cluster replication receiver (prior to version 2026.06.1) allows any peer with access to the cluster network to inject or replay MsgReplicateSync messages, silently corrupting replicated telemetry data across all cluster nodes. The CVSS 4.0 score of 8.3 reflects high integrity impact on both the vulnerable system and subsequent cluster peers (VI:H, SI:H) with only low privilege requirements, scoped to cluster-mode deployments. A vendor-released patch is available in version 2026.06.1; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Path traversal in Arc Enterprise's Raft finite state machine allows low-privileged cluster peers to register arbitrary file paths via manifest-registration proposals, bypassing all path validation in the applyRegisterFile handler (internal/cluster/raft/fsm.go). All Arc Enterprise deployments running in cluster mode prior to version 2026.06.1 are affected. No public exploit code has been identified at time of analysis, but successful exploitation enables data writes outside the configured storage backend root, directly undermining storage isolation guarantees.
Path traversal in Nozomi Networks Arc's local web interface allows a local administrator to delete arbitrary files on the host system by submitting a crafted archive name containing directory traversal sequences to the Offline archives functionality. The Arc process executes with administrative privileges on the host, meaning the deletable file scope extends well beyond the web interface's normal reach. No public exploit code exists and this is not listed in CISA KEV; exploitation is constrained by the requirement for both local access and administrative web interface credentials.
Nozomi Networks Arc for Windows installs the Npcap packet capture driver with its access restriction option left at the insecure default, making the driver accessible to all local users rather than administrators only. Any non-privileged local user on an affected host can leverage this misconfiguration to capture network traffic traversing the host's interfaces - exposing data from both the local system and peer hosts on the same network segment - and to inject arbitrary raw packets onto that segment. No public exploit has been identified and the CVSS 4.0 score of 4.8 reflects the local-access prerequisite; however, the dual capability of traffic capture and packet injection is operationally significant in the OT/ICS environments where Arc is primarily deployed, where industrial protocols are often unencrypted.
The server certificate was not verified when an Arc agent connected to a Guardian or CMC. A malicious actor could perform a man-in-the-middle attack and intercept the communication between the Arc agent and the Guardian or CMC. [CVSS 6.5 MEDIUM]
Arc before 1.26.1 on Windows has a bypass issue in the site settings that allows websites (with previously granted permissions) to add new permissions when the user clicks anywhere on the website.
CData RSB Connect v22.0.8336 was discovered to contain a Server-Side Request Forgery (SSRF). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Address bar spoofing in Arc Browser lets remote, unauthenticated attackers paint a convincing fake address bar over the genuine browser chrome by embedding a <select> element on an attacker-controlled page that invokes the Fullscreen API; because Arc fails to display the expected fullscreen notification, the victim never gets the visual cue that would normally reveal the browser is in a special display state. Exploitation is gated on user interaction - the victim must open the malicious page and engage with the select element - and the outcome is deception/phishing rather than code execution or direct data access, which is why the authoritative assessment lowers the integrity impact to I:L instead of the I:H in the widely-cited 7.4 vector. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Missing application-layer authentication in Arc Enterprise's cluster replication receiver (prior to version 2026.06.1) allows any peer with access to the cluster network to inject or replay MsgReplicateSync messages, silently corrupting replicated telemetry data across all cluster nodes. The CVSS 4.0 score of 8.3 reflects high integrity impact on both the vulnerable system and subsequent cluster peers (VI:H, SI:H) with only low privilege requirements, scoped to cluster-mode deployments. A vendor-released patch is available in version 2026.06.1; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Path traversal in Arc Enterprise's Raft finite state machine allows low-privileged cluster peers to register arbitrary file paths via manifest-registration proposals, bypassing all path validation in the applyRegisterFile handler (internal/cluster/raft/fsm.go). All Arc Enterprise deployments running in cluster mode prior to version 2026.06.1 are affected. No public exploit code has been identified at time of analysis, but successful exploitation enables data writes outside the configured storage backend root, directly undermining storage isolation guarantees.
Path traversal in Nozomi Networks Arc's local web interface allows a local administrator to delete arbitrary files on the host system by submitting a crafted archive name containing directory traversal sequences to the Offline archives functionality. The Arc process executes with administrative privileges on the host, meaning the deletable file scope extends well beyond the web interface's normal reach. No public exploit code exists and this is not listed in CISA KEV; exploitation is constrained by the requirement for both local access and administrative web interface credentials.
Nozomi Networks Arc for Windows installs the Npcap packet capture driver with its access restriction option left at the insecure default, making the driver accessible to all local users rather than administrators only. Any non-privileged local user on an affected host can leverage this misconfiguration to capture network traffic traversing the host's interfaces - exposing data from both the local system and peer hosts on the same network segment - and to inject arbitrary raw packets onto that segment. No public exploit has been identified and the CVSS 4.0 score of 4.8 reflects the local-access prerequisite; however, the dual capability of traffic capture and packet injection is operationally significant in the OT/ICS environments where Arc is primarily deployed, where industrial protocols are often unencrypted.
The server certificate was not verified when an Arc agent connected to a Guardian or CMC. A malicious actor could perform a man-in-the-middle attack and intercept the communication between the Arc agent and the Guardian or CMC. [CVSS 6.5 MEDIUM]
Arc before 1.26.1 on Windows has a bypass issue in the site settings that allows websites (with previously granted permissions) to add new permissions when the user clicks anywhere on the website.
CData RSB Connect v22.0.8336 was discovered to contain a Server-Side Request Forgery (SSRF). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.