Nozomi Networks vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-33924 Two OS command injection vulnerabilities were discovered in the update installation functionality due to insufficient validation of the update bundle contents.High 7.5 · Oct 29, 2026
• CVE-2026-33923 A signature verification vulnerability was discovered in the update installation functionality due to inconsistent validation of the update bundle contents.High 7.5 · Oct 29, 2026
• CVE-2026-33390 An Incorrect Privilege Assignment vulnerability was discovered in the synchronization functionality due to Arc sensors receiving CLI permissions.High 7.2 · Jul 9, 2026
• CVE-2026-31985 When the upstream Guardian or CMC was configured in the Remote Collector via n2os-tui, the generated configuration disabled TLS certificate verification, and noHigh 8.3 · Jul 9, 2026
• CVE-2026-31984 A denial-of-service vulnerability caused by unbounded resource allocation was discovered in the audit logging functionality, due to a missing size limit on inpuHigh 8.7 · Jul 9, 2026
• CVE-2025-40899 A Stored Cross-Site Scripting vulnerability was discovered in the Assets and Nodes functionality due to improper validation of an input parameter.High 7.1 · Apr 15, 2026
• CVE-2025-40897 An access control vulnerability was discovered in the Threat Intelligence functionality due to a specific access restriction not being properly enforced for useHigh 7.2 · Apr 15, 2026
• CVE-2025-40898 A path traversal vulnerability was discovered in the Import Arc data archive functionality due to insufficient validation of the input file.High 7.2 · Dec 18, 2025
• CVE-2025-40892 A Stored Cross-Site Scripting vulnerability was discovered in the Reports functionality due to improper validation of an input parameter.High 7.1 · Dec 18, 2025
• CVE-2025-40889 A path traversal vulnerability was discovered in the Time Machine functionality due to missing validation of two input parameters.High 7.2 · Oct 7, 2025
• CVE-2025-40886 A SQL Injection vulnerability was discovered in the Alert functionality due to improper validation of an input parameter.High 7.7 · Oct 7, 2025
• CVE-2025-3719 An access control vulnerability was discovered in the CLI functionality due to a specific access restriction not being properly enforced for users with limited High 7.2 · Oct 7, 2025
• CVE-2024-13090 A privilege escalation vulnerability may enable a service account to elevate its privileges.High 7.3 · Jun 10, 2025
• CVE-2024-13089 An OS command injection vulnerability within the update functionality may allow an authenticated administrator to execute unauthorized arbitrary OS commands.High 7.5 · Jun 10, 2025
• CVE-2023-5938 Multiple functions use archives without properly validating the filenames therein, rendering the application vulnerable to path traversal via 'zip slip' attacksHigh 8.9 · May 15, 2024
• CVE-2023-5936 On Unix systems (Linux, MacOS), Arc uses a temporary file with unsafe privileges.High 7.3 · May 15, 2024
• CVE-2023-5935 When configuring Arc (e.g.High 7.3 · May 15, 2024
• CVE-2024-0218 A Denial of Service (Dos) vulnerability in Nozomi Networks Guardian, caused by improper input validation in certain fields used in the Radius parsing functionalHigh 8.2 · Apr 10, 2024
• CVE-2023-6916 Audit records for OpenAPI requests may include sensitive information.High 7.5 · Apr 10, 2024
• CVE-2023-32649 A Denial of Service (Dos) vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in certain fields used in the Asset Intelligence fHigh 8.2 · Sep 19, 2023
• CVE-2023-2567 A SQL Injection vulnerability has been found in Nozomi Networks Guardian and CMC, due to improper input validation in certain parameters used in the Query functHigh 8.7 · Sep 19, 2023
• CVE-2023-29245 A SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in certain fields used in the Asset Intelligence functionaliCritical 9.2 · Sep 19, 2023
• CVE-2023-24471 An access control vulnerability was found, due to the restrictions that are applied on actual assertions not being enforced in their debug functionality.High 7.1 · Aug 9, 2023
• CVE-2023-23574 A blind SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in the alerts_count component, allows an authenticatedHigh 8.7 · Aug 9, 2023
• CVE-2023-22843 An authenticated attacker with administrative access to the web management interface can inject malicious JavaScript code inside the definition of a Threat InteHigh 7.3 · Aug 9, 2023