# CVE-2026-33924: Nozomi Networks Guardian/CMC OS command injection in update installer

Source: https://junglewise.ai/threats/cve-2026-33924-two-os-command-injection-vulnerabilities-were-discovered-in-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-29. Updated: 2026-10-29  
License: CC BY 4.0 with a link back

CVE-2026-33924 · Severity: high · CVSS 7.2 · Published 2026-10-29

Guardian and CMC are network security appliances that manage updates and configuration across industrial networks. Two OS command injection flaws in the update installation process allow authenticated administrators to execute arbitrary commands with root privileges by providing a crafted update bundle. An attacker with admin access could read sensitive data, modify configurations, or disable the appliance entirely.

Technologies: [Nozomi Networks Guardian](https://junglewise.ai/threats/technologies/guardian). Vendors: [Nozomi Networks](https://junglewise.ai/threats/vendors/nozomi-networks).

## Quick answers

**Is CVE-2026-33924 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33924 being exploited in the wild.

**How severe is CVE-2026-33924?** High severity, with a CVSS score of 7.2, published 29 October 2026.

**Which products and versions are affected?** Nozomi Networks CMC before 26.4.0; Nozomi Networks Guardian before 26.4.0.

**Is there a fix for CVE-2026-33924?** Yes: fixed in Guardian 26.4.0, CMC 26.4.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-33924 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-33924?** Check whether you run Nozomi Networks CMC or Nozomi Networks Guardian at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Guardian 26.4.0, CMC 26.4.0

## Technical details

Two OS command injection vulnerabilities (CWE-78) exist in the update installation functionality due to insufficient validation of update bundle contents. An authenticated attacker with administrative privileges can craft a malicious update bundle that, when installed, executes arbitrary OS commands with root privileges. No user interaction is required; the attacker only needs valid admin credentials and network access to the appliance.

## Affected products

- Nozomi Networks Guardian before 26.4.0
- Nozomi Networks CMC before 26.4.0

## Timeline

- 2026-10-29: disclosed

## References

- [https://security.nozominetworks.com/NN-2026:22-01](https://security.nozominetworks.com/NN-2026:22-01)

## Related threats

- [Nozomi Networks Guardian/CMC update signature bypass](https://junglewise.ai/threats/cve-2026-33923-a-signature-verification-vulnerability-was-discovered-in-the)
- [Nozomi Networks Guardian and CMC cross-site request forgery in login](https://junglewise.ai/threats/cve-2026-33920-nozomi-networks-guardian-and-cmc-cross-site-request-forgery-in)
- [Nozomi Guardian/CMC incorrect authorization in Smart Polling configuration](https://junglewise.ai/threats/cve-2026-33391-nozomi-guardian-cmc-incorrect-authorization-in-smart-polling)
- [Nozomi Networks Guardian/CMC and Arc improper certificate validation in Smart Polling](https://junglewise.ai/threats/cve-2026-33389-nozomi-networks-guardian-cmc-and-arc-improper-certificate)
- [Nozomi Networks Guardian/CMC incorrect authorization in Credentials Manager](https://junglewise.ai/threats/cve-2026-33388-nozomi-networks-guardian-cmc-incorrect-authorization-in)