Is CVE-2026-33923 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-33923 being exploited in the wild.

How severe is CVE-2026-33923?

High severity, with a CVSS score of 7.2, published 29 October 2026.

Which products and versions are affected?

Nozomi Networks CMC before 26.4.0; Nozomi Networks Guardian before 26.4.0.

Is there a fix for CVE-2026-33923?

Yes: fixed in Guardian 26.4.0, CMC 26.4.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-33923 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-33923?

Check whether you run Nozomi Networks CMC or Nozomi Networks Guardian at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33923: Nozomi Networks Guardian/CMC update signature bypass

CVE-2026-33923 · Severity: high · CVSS 7.2 · Published 2026-10-29

Guardian and CMC are network monitoring and industrial control appliances used to protect critical infrastructure. A vulnerability in their update mechanism allows an authenticated administrator to install a crafted update that passes signature verification but executes unsigned malicious scripts with root privileges, enabling complete compromise of the device.

Technologies: Nozomi Networks Guardian. Vendors: Nozomi Networks.

Quick answers

Is CVE-2026-33923 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-33923 being exploited in the wild.
How severe is CVE-2026-33923?: High severity, with a CVSS score of 7.2, published 29 October 2026.
Which products and versions are affected?: Nozomi Networks CMC before 26.4.0; Nozomi Networks Guardian before 26.4.0.
Is there a fix for CVE-2026-33923?: Yes: fixed in Guardian 26.4.0, CMC 26.4.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33923 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-33923?: Check whether you run Nozomi Networks CMC or Nozomi Networks Guardian at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Guardian 26.4.0, CMC 26.4.0

Technical details

A signature verification flaw in the update installation process (CWE-347: Improper Verification of Cryptographic Signature) allows inconsistent validation of update bundle contents. An attacker with administrative privileges can supply a specially crafted update bundle that passes signature verification but contains unsigned scripts that execute during installation with root privileges. This requires network access and valid administrative credentials but no user interaction.

Affected products

Nozomi Networks Guardian before 26.4.0
Nozomi Networks CMC before 26.4.0

Timeline

2026-10-29: disclosed

References

https://security.nozominetworks.com/NN-2026:21-01

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.