CVE-2026-33387
Medium
Description
A template injection vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter. An authenticated user with the required privileges can define a dashboard containing a malicious payload, or a victim can be socially engineered into importing a malicious dashboard. When the victim views or imports the dashboard, the payload executes in their browser context, allowing the attacker to modify application data or disrupt application availability.
SeverityMedium
CVSS4.6
Exploit probability—
ProductGuardian
PublishedSep 8, 2026
First seenSep 8, 2026
Weakness typeCWE-1336CWE-1336
How to fix
Update
- Nozomi Networks Guardian26.3.0 or later
- Nozomi Networks CMC26.3.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Nozomi Networks Guardian | v < 26.3.0 | 26.3.0 |
| Nozomi Networks CMC | v < 26.3.0 | 26.3.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.