CVE-2026-33391: CWE-863 Incorrect authorization in Nozomi Networks Guardian

This vulnerability (CVE-2026-33391) in Nozomi Networks Guardian arises from insufficient validation of user privileges in the Smart Polling configuration functionality. An authenticated user with limited privileges can remotely bypass access controls on the web management interface and alter the Smart Polling discovery configuration. This flaw allows disruption of asset visibility in the network monitored by Guardian. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no user interaction, and limited privileges required.

An attacker with limited authenticated access can bypass intended access controls to modify Smart Polling discovery settings, potentially disrupting the visibility of assets in the monitored network. This could impair network monitoring and asset management but does not indicate direct code execution or data disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict access to the web management interface to trusted users only and monitor for unauthorized configuration changes.