# CVE-2026-33920: Nozomi Networks Guardian and CMC cross-site request forgery in login

Source: https://junglewise.ai/threats/cve-2026-33920-nozomi-networks-guardian-and-cmc-cross-site-request-forgery-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-08. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-33920 · Severity: low · CVSS 3.5 · Published 2026-09-08

Guardian and CMC are network security monitoring and management platforms used by industrial and enterprise organizations. A CSRF vulnerability in the login functionality allows an attacker with a valid account to trick a victim into unknowingly authenticating as the attacker, causing all subsequent actions to be attributed to the attacker's account and compromising the audit trail.

Technologies: [Nozomi Networks Guardian](https://junglewise.ai/threats/technologies/guardian). Vendors: [Nozomi Networks](https://junglewise.ai/threats/vendors/nozomi-networks).

## Quick answers

**Is CVE-2026-33920 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33920 being exploited in the wild.

**How severe is CVE-2026-33920?** Low severity, with a CVSS score of 3.5, published 8 September 2026.

**Which products and versions are affected?** Nozomi Networks Guardian before 26.3.0.

**Is there a fix for CVE-2026-33920?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-33920 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-33920?** Check whether you run Nozomi Networks Guardian at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a cross-site request forgery (CWE-352) vulnerability in the login functionality of Guardian and CMC resulting from missing validation of anti-CSRF tokens for both standard and SAML-based authentication. The attack requires the attacker to have a valid account and the victim to interact with a malicious webpage while authenticated to the target system. An authenticated attacker can forge login requests that cause a victim to unknowingly assume the attacker's identity, leading to operation attribution, audit trail compromise, and potential unauthorized access. The vulnerability affects versions before 26.3.0; patched versions are available.

## Affected products

- Nozomi Networks Guardian before 26.3.0
- Nozomi Networks CMC before 26.3.0

## Timeline

- 2026-09-08: disclosed

## References

- [https://security.nozominetworks.com/NN-2026:18-01](https://security.nozominetworks.com/NN-2026:18-01)

## Related threats

- [Nozomi Networks Guardian/CMC OS command injection in update installer](https://junglewise.ai/threats/cve-2026-33924-two-os-command-injection-vulnerabilities-were-discovered-in-the)
- [Nozomi Networks Guardian/CMC update signature bypass](https://junglewise.ai/threats/cve-2026-33923-a-signature-verification-vulnerability-was-discovered-in-the)
- [Nozomi Guardian/CMC incorrect authorization in Smart Polling configuration](https://junglewise.ai/threats/cve-2026-33391-nozomi-guardian-cmc-incorrect-authorization-in-smart-polling)
- [Nozomi Networks Guardian/CMC and Arc improper certificate validation in Smart Polling](https://junglewise.ai/threats/cve-2026-33389-nozomi-networks-guardian-cmc-and-arc-improper-certificate)
- [Nozomi Networks Guardian/CMC incorrect authorization in Credentials Manager](https://junglewise.ai/threats/cve-2026-33388-nozomi-networks-guardian-cmc-incorrect-authorization-in)