Is CVE-2025-40899 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-40899 being exploited in the wild.

How severe is CVE-2025-40899?

High severity, with a CVSS score of 8.9, published 15 April 2026.

Which products and versions are affected?

Nozomi Networks Central Management Console < 26.0.0; Nozomi Networks Guardian < 26.0.0; Siemens Ruggedcom Ape1808 All versions with Nozomi Guardian/CMC < V26.2.0.

Is there a fix for CVE-2025-40899?

A patch was published on 2026-04-15: Nozomi Networks released version 26.0.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-40899 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2025-40899?

Check whether you run Nozomi Networks Central Management Console, Nozomi Networks Guardian or Siemens Ruggedcom Ape1808 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-40899: Nozomi Networks Guardian and CMC stored XSS in Assets and Nodes

Q: Is there a fix for CVE-2025-40899?

A patch was published on 2026-04-15: Nozomi Networks released version 26.0.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2025-40899 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2025-40899?

Check whether you run Nozomi Networks Central Management Console, Nozomi Networks Guardian or Siemens Ruggedcom Ape1808 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-40899 · Severity: high · CVSS 8.9 · Published 2026-04-15

Nozomi Networks Guardian and CMC, which are used for industrial network monitoring and management, are affected by a security vulnerability in their Assets and Nodes management features. An authenticated user with permission to create custom fields can inject malicious scripts that execute when other users view those pages. This could allow an attacker to hijack administrative sessions, modify application data, or disrupt the availability of the monitoring platform.

Technologies: Nozomi Networks Central Management Console, Nozomi Networks Guardian, Siemens Ruggedcom Ape1808. Vendors: Nozomi Networks, Siemens.

Quick answers

Is CVE-2025-40899 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-40899 being exploited in the wild.
How severe is CVE-2025-40899?: High severity, with a CVSS score of 8.9, published 15 April 2026.
Which products and versions are affected?: Nozomi Networks Central Management Console < 26.0.0; Nozomi Networks Guardian < 26.0.0; Siemens Ruggedcom Ape1808 All versions with Nozomi Guardian/CMC < V26.2.0.
Is there a fix for CVE-2025-40899?: A patch was published on 2026-04-15: Nozomi Networks released version 26.0.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-40899 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-40899?: Check whether you run Nozomi Networks Central Management Console, Nozomi Networks Guardian or Siemens Ruggedcom Ape1808 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in the Assets and Nodes functionality of Nozomi Networks Guardian and CMC due to improper validation of input parameters within custom fields. An authenticated attacker with 'custom fields' privileges can define a field containing a malicious JavaScript payload. When a victim (such as an administrator) views the Assets or Nodes pages, the payload executes in their browser context. This can lead to unauthorized actions performed on behalf of the victim, including data modification, session hijacking, and disruption of application availability. The vulnerability is addressed in Nozomi version 26.0.0 and Siemens RUGGEDCOM APE1808 Nozomi Guardian version 26.2.0.

Affected products

Nozomi Networks Inc. Guardian < 26.0.0
Nozomi Networks Inc. Central Management Console (CMC) < 26.0.0
Siemens RUGGEDCOM APE1808 All versions with Nozomi Guardian/CMC < V26.2.0

Timeline

2026-01-13: advisory: Initial Siemens advisory published
2026-04-15: disclosed: Initial Nozomi Networks advisory published
2026-04-15: patched: Nozomi Networks released version 26.0.0
2026-05-12: patched: Siemens released update for RUGGEDCOM APE1808

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.