CVE-2026-33390CWE-266

CVE-2026-33390

High · published July 9, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
33.2
In the wild
Unconfirmed
What it is

An Incorrect Privilege Assignment vulnerability was discovered in the synchronization functionality due to Arc sensors receiving CLI permissions. An authenticated user with limited privileges can push administrative CLI commands through the sync, altering the device configuration, and/or affecting its availability.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00401 · 33.2th percentile
Weakness
CWE-266 · Incorrect Privilege Assignment
Published
2026-07-09T12:16Z
Affected products (2)
ProductVersionsFixed in
nozominetworks/cmc< 26.2.026.2.0
nozominetworks/guardian< 26.2.026.2.0
References (2)
https://security.nozominetworks.com/NN-2026:13-01 · [email protected]https://cert-portal.siemens.com/productcert/html/ssa-827968.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
EPSS history
Timeline
  • 09 JUL 07:23Z
    Incorrect privilege assignment for Arc sensors in Guardian/CMC before 26.2.0
    cvelistv5