VULNERABILITY INTELLIGENCE

CVE-2026-33390

CVSS score8.1 HIGH
EPSS probability0.40%
CISA KEVNot currently listed
Published2026-07-09
Last modified2026-08-11
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Description

An Incorrect Privilege Assignment vulnerability was discovered in the synchronization functionality due to Arc sensors receiving CLI permissions. An authenticated user with limited privileges can push administrative CLI commands through the sync, altering the device configuration, and/or affecting its availability.

Weakness classification

  • prodsec@nozominetworks.com: CWE-266

Primary references