Nozomi Guardian and CMC 26.4.0 Fix Update-Path Root Execution
Tech GuruQuick Answer
Nozomi advisories NN-2026:21-01 and NN-2026:22-01 affect Guardian and CMC before 26.4.0. Inventory appliances and administrative access, preserve evidence if update activity is suspicious, upgrade to 26.4.0, validate monitoring and management, and retain proof.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory Guardian and CMC appliances, exact versions, administrators, update history and repositories, management exposure, integrations, owners, backups, and maintenance windows. Confirm the appliance is before 26.4.0 and that the attacker could administer update installation; do not infer unauthenticated exposure or compromise from the high rating alone. Upgrade Guardian and CMC to 26.4.0 or later through Nozomi's supported channel and restrict administrative and update paths while rollout is pending. Confirm the running version and update provenance, test sensor ingestion, alerting, management and integrations, review unusual update or administrator activity, and retain appliance and change evidence.
Last verified: 2026-10-29 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Nozomi Networks Guardian and Central Management Console update installation |
|---|---|
| Advisory | NN-2026:21-01 / NN-2026:22-01 |
| CVEs | CVE-2026-33923, CVE-2026-33924 |
| Authoritative release date | 2026-10-29 10:46:35.814 UTC |
| Authority revision date | 2026-10-29 12:36:53.310 UTC |
| Affected versions | Guardian and CMC releases before 26.4.0; exploitation requires an attacker with administrative privileges who can supply and install a crafted update bundle. |
| Fixed version | Nozomi Networks Guardian and CMC 26.4.0 or later |
| CVSS base score | 7.5 (CVSS v4.0); 7.2 (CVSS v3.1) |
| CVSS severity | High |
| Exploitation status | Nozomi Networks does not state that these vulnerabilities are being maliciously exploited.; no exploitation claim is inferred. |
What Changed
Nozomi fixed signature-verification inconsistency and command injection in update bundles that can let an administrator execute unsigned commands as root.
What To Validate Now
- Inventory. Inventory Guardian and CMC appliances, exact versions, administrators, update history and repositories, management exposure, integrations, owners, backups, and maintenance windows.
- Establish applicability. Confirm the appliance is before 26.4.0 and that the attacker could administer update installation; do not infer unauthenticated exposure or compromise from the high rating alone.
- Remediate. Upgrade Guardian and CMC to 26.4.0 or later through Nozomi's supported channel and restrict administrative and update paths while rollout is pending.
- Validate. Confirm the running version and update provenance, test sensor ingestion, alerting, management and integrations, review unusual update or administrator activity, and retain appliance and change evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
These appliances support security monitoring in operational environments. Coordinate maintenance and preserve update bundles, logs and access evidence before cleanup when suspicious activity is present.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
