---
id: "CVE-2026-33924"
kind: "vulnerability"
aliases: ["CVE-2026-33924"]
title: "Appliance update installer lets an admin run root commands via crafted bundle"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Nozomi Networks Guardian", "fixed": ["26.4.0"], "affected": "< 26.4.0", "ecosystem": "vendor"}, {"name": "Nozomi Networks CMC", "fixed": ["26.4.0"], "affected": "< 26.4.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["appliance", "cmc", "guardian", "infrastructure", "nozomi", "ot-security", "update-bundle"]
not_affected_if: ["management-interface-restricted", "no-admin-exposure"]
published_at: "2026-10-29T11:17:33+00:00"
first_seen_at: "2026-10-29T11:24:28+00:00"
updated_at: "2026-10-29T11:26:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33924", "first_seen_at": "2026-10-29T11:24:28+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-29T11:26:52+00:00"}]
---

# Appliance update installer lets an admin run root commands via crafted bundle

Two OS command injection flaws in the update installer of Nozomi Networks Guardian and CMC before 26.4.0. An admin can upload a crafted update bundle that runs commands as root. Fixed in 26.4.0.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Nozomi Networks Guardian affected < 26.4.0 fixed 26.4.0
- vendor:Nozomi Networks CMC affected < 26.4.0 fixed 26.4.0

## How to check

Check the Guardian/CMC software version in the web UI or CLI; any version below 26.4.0 is affected. Also review which accounts hold administrative privileges.

## Fix

Upgrade Nozomi Networks Guardian and CMC to v26.4.0 or later.

## Timeline

- 2026-10-29T11:24:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-33924
- 2026-10-29T11:26:52+00:00 analyst — Nozomi Networks advisory NN-2026:22-01 read; Guardian/CMC < 26.4.0, fixed in 26.4.0. Sibling CVE-2026-33923 (NN-2026:21-01, signature bypass) fixed same version. No exploitation or PoC found; no social search done (B tier).

## Documents

- [advisory] NN-2026:22-01 Authenticated RCE in update functionality in Guardian/CMC before 26.4.0 https://security.nozominetworks.com/NN-2026:22-01

## From the sources

Two OS command injection vulnerabilities were discovered in the update installation functionality due to insufficient validation of the update bundle contents. An attacker with administrative privileges can remotely supply a crafted update bundle that, when installed, causes arbitrary commands to be executed with root privileges, allowing the attacker to read or modify sensitive data, change the appliance configuration, or shut down the appliance.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_