CVE-2026-33924

HighCVSS 7.2/10Last modified Oct 29, 2026

Description

Two OS command injection vulnerabilities were discovered in the update installation functionality due to insufficient validation of the update bundle contents. An attacker with administrative privileges can remotely supply a crafted update bundle that, when installed, causes arbitrary commands to be executed with root privileges, allowing the attacker to read or modify sensitive data, change the appliance configuration, or shut down the appliance.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Nozomi Networks	Guardian	< 26.4.0
Nozomi Networks	CMC	< 26.4.0

References

https://security.nozominetworks.com/NN-2026:22-01

Timeline

Published: Oct 29, 2026
Last modified: Oct 29, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-339294.3Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache PDFBox Examples. This issue affects CVE-2026-33937.8A security vulnerability has been detected in jarikomppa soloud up to 20200207. The impacted element is the function SoLoud::Wav::loadflac o CVE-2026-339305.9Apache Traffic Server copies the client Host header into a fixed-size stack buffer without a bound during redirect handling, so an over-long CVE-2026-339316.5OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, an Insecu CVE-2026-339325.4OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, a stored CVE-2026-339336.1OpenEMR is a free and open source electronic health records and medical practice management application. Starting in version 7.0.2.1 and pri CVE-2026-339344.3OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.3 have a mi CVE-2026-339357.5MyTube is a self-hosted downloader and player for several video websites Prior to version 1.8.72, an unauthenticated attacker can lock out a CVE-2026-339365.3The `ecdsa` PyPI package is a pure Python implementation of ECC (Elliptic Curve Cryptography) with support for ECDSA (Elliptic Curve Digital CVE-2026-339379.8Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `Handlebars.compile()` accep CVE-2026-339388.1Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the `@partial-block` special CVE-2026-339397.5Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, when a Handlebars template c