CVE-2026-33388: CWE-863 Incorrect authorization in Nozomi Networks Guardian

This vulnerability arises from insufficient validation of user privileges in the Credentials Manager functionality of Nozomi Networks Guardian. Remote authenticated users with limited privileges can view a limited subset of credential entries and have the ability to delete or modify these entries' properties. Although the credential values themselves are not directly visible, manipulation of these entries can disrupt authentication processes or indirectly lead to credential exposure. The issue is classified under CWE-863 (Incorrect Authorization).

An attacker with limited authenticated access can delete or modify credential entries, which may disrupt authentication for devices relying on those credentials. Additionally, by manipulating entry configurations, an attacker might indirectly obtain credential information. The vulnerability does not allow direct viewing of credential values but can cause denial of service or indirect credential compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided. Until a patch is available, restrict access to the Credentials Manager to trusted users only and monitor for unauthorized changes.