CVE-2026-33390 HIGH

CVE-2026-33390: Incorrect privilege assignment for Arc sensors in Guardian/CMC before 26.2.0

Vendor Nozomi Networks
Product Guardian
Weakness CWE-266
Published July 9, 2026
Last update July 9, 2026
View on NVD All CVEs

CVSS base score

7.2/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

An Incorrect Privilege Assignment vulnerability was discovered in the synchronization functionality due to Arc sensors receiving CLI permissions. An authenticated user with limited privileges can push administrative CLI commands through the sync, altering the device configuration, and/or affecting its availability.

Key dates

02Disclosure timeline

July 9, 2026 CVE published
July 9, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-42680 WordPress Contest Gallery Pro plugin <= 29.0.1 - Privilege Escalation vulnerability CVE-2026-32519 WordPress Bit SMTP plugin <= 1.2.2 - Broken Authentication vulnerability CVE-2026-48879 WordPress AIWU plugin <= 1.4.17 - Privilege Escalation vulnerability CVE-2025-53209 WordPress Masteriyo LMS PRO plugin <= 2.20.0 - Privilege Escalation Vulnerability CVE-2026-25334 WordPress Salon Booking System Pro plugin < 10.30.12 - Account Takeover vulnerability