High severity8.1NVD Advisory· Published Jul 9, 2026· Updated Aug 11, 2026

CVE-2026-33390

Description

An Incorrect Privilege Assignment vulnerability was discovered in the synchronization functionality due to Arc sensors receiving CLI permissions. An authenticated user with limited privileges can push administrative CLI commands through the sync, altering the device configuration, and/or affecting its availability.

Affected products

Nozominetworks/Cmc
cpe:2.3:a:nozominetworks:cmc:*:*:*:*:*:*:*:*
Range: <26.2.0
Nozominetworks/Guardian
cpe:2.3:a:nozominetworks:guardian:*:*:*:*:*:*:*:*
Range: <26.2.0
Nozominetworks/Arc sensorsllm-create

Patches

Vulnerability mechanics

References

security.nozominetworks.com/NN-2026:13-01nvdMitigationVendor Advisory
cert-portal.siemens.com/productcert/html/ssa-827968.htmlnvd

News mentions

No linked articles in our index yet.

cvss	0.526
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000