CVE-2026-33391CWE-863broken-access-control

CVE-2026-33391

Medium · published September 8, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
28.0
In the wild
Unconfirmed
What it is

An access control vulnerability was discovered in the Smart Polling configuration functionality due to insufficient validation of user privileges. An authenticated user with limited privileges can remotely bypass the intended access control of the web management interface and modify the Smart Polling discovery configuration. This allows the attacker to disrupt the visibility of assets in the monitored network.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00355 · 28.0th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-09-08T18:17Z
References (2)
https://security.nozominetworks.com/NN-2026:17-01 · [email protected]https://cert-portal.siemens.com/productcert/html/ssa-911336.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
EPSS history
Timeline
  • 10 SEP 03:16Z
    EPSS moved — → 0%
    epss
  • 08 SEP 13:56Z
    Incorrect authorization in Smart Polling configuration in Guardian/CMC before 26.3.0
    cvelistv5