CVE-2025-40901: Nozomi Networks Guardian and CMC HTML injection in Credentials Manager

CVE-2025-40901 · Severity: medium · CVSS 5.9 · Published 2026-05-19

A security vulnerability exists in the Credentials Manager of Nozomi Networks Guardian and CMC, which are platforms used to monitor and secure industrial and OT networks. An administrative user can save malicious code that triggers when another user attempts to delete a specific identity. This could be used to perform phishing attacks or redirect users to malicious websites, though existing security controls prevent full system takeover or direct data theft.

Quick answers

Is CVE-2025-40901 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-40901 being exploited in the wild.
How severe is CVE-2025-40901?
Medium severity, with a CVSS score of 5.9, published 19 May 2026.
Which products and versions are affected?
Nozomi Networks Inc. Guardian < 26.1.0; Nozomi Networks Inc. Central Management Console (CMC) < 26.1.0.
Is there a fix for CVE-2025-40901?
A patch was published on 2026-05-19: Fixed in version 26.1.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-40901 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-40901?
Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Stored HTML Injection vulnerability (CWE-79) exists in the Credentials Manager functionality of Nozomi Networks Guardian and CMC due to improper validation of input parameters. An authenticated attacker with administrative privileges can define a malicious identity containing arbitrary HTML tags. The payload is executed in the victim's browser when they attempt to delete the affected identity. While the existing Content Security Policy (CSP) and input validation prevent full Cross-Site Scripting (XSS) and direct information disclosure, the flaw enables phishing and open redirect attacks. The issue is resolved in version 26.1.0.

Affected products

  • Nozomi Networks Inc. Guardian < 26.1.0
  • Nozomi Networks Inc. Central Management Console (CMC) < 26.1.0

Timeline

  • 2026-05-19: disclosed: Initial advisory release by Nozomi Networks
  • 2026-05-19: patched: Fixed in version 26.1.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.