The vulnerability CVE-2026-33921 involves the Windows installer for Nozomi Networks Arc deploying the Npcap driver with its access restriction option set to an insecure default. This configuration permits all local users, not just administrators, to access the driver. Consequently, a local user without administrative privileges can capture network traffic destined for the host and other systems on the same network segment, as well as send arbitrary raw packets on that segment. This is classified under CWE-1188, indicating initialization of a resource with an insecure default. The CVSS 4.0 base score is 4.8, reflecting a medium severity with local attack vector and low complexity.

A local user without administrative privileges can exploit this vulnerability to capture sensitive network traffic and inject arbitrary packets on the local network segment. This could lead to information disclosure of data belonging to the host and other systems on the same network segment. However, the attack requires local access and low privileges, and the overall impact is rated medium severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or update is provided by Nozomi Networks, users should consider restricting local user access to the Npcap driver manually or deploying compensating controls to limit local user capabilities. Monitor vendor communications for updates on remediation.