Nozomi Guardian/CMC Stored HTML Injection Vulnerability CVE-2026-21981

Vulnerability Overview Vulnerability ID: NN-2026:8-01 Vulnerability Type: HTML Injection Affected Components: Diagram tab and Graph view in Guardian/CMC Vulnerability Description: A stored HTML injection vulnerability was identified in the Diagram tab and Graph view due to insufficiently strict shared input validation functions. CVE Number: CVE-2026-21981 CWE Impact: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Publication Date: 2026-07-07 CVSS Score: - CVSS v4.0: 4.8 - CVSS v3.1: 5.9 Risk Level: - CVSS v4.0: Medium - CVSS v3.1: Medium Impact on Nozomi Customers: Low Scope of Impact Affected Products: Guardian, CMC < v26.2.0 Specific Impact: Users with administrative privileges can inject malicious HTML tags into NZOS configuration data through multiple input vectors. When victims view data in the Diagram tab and Graph view, the injected HTML is rendered in their browsers, potentially leading to phishing attacks and possible open redirect attacks. Existing input validation and Content Security Policy configurations prevent full XSS exploitation and direct information disclosure. Remediation Solution: Upgrade to v26.2.0 or later. Temporary Mitigation: Use internal firewall features to restrict access to the Web management interface. Review all accounts with administrative access and remove unnecessary accounts. Change History 2026-07-07: Initial revision Related Links Mitre CVE entry: Link Acknowledgments Thanks to the following individuals for their efforts: - Stefano Libero, Andrea Palanca of the Nozomi Networks Product Security team Contact The Nozomi Networks Product Security team can be contacted at prodsec@nozominetworks.com. For more contact details, please see the PSIRT page.

Goal Reached Thanks to every supporter — we hit 100%!

Nozomi Guardian/CMC Stored HTML Injection Vulnerability CVE-2026-21981