CVE-2026-33921
Received Received - Intake

Npcap Driver Local Privilege Escalation Vulnerability

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: Nozomi Networks Inc.

Description
The Windows installer deployed Npcap leaving its access restriction option at the insecure default value, so the driver was accessible to every local user of the host instead of being restricted to administrators only. A local user without administrative privileges could use the Npcap driver to capture the traffic reaching the host, which discloses information belonging both to the host and to other systems on the same network segment, and to send arbitrary raw packets on that segment.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-33921
EUVD
EUVD-2026-55995

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
npcap npcap *
nozomi_networks arc to 2.7.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1188 The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-33921 is a vulnerability in Npcap's Windows installer where the driver's access restriction was set to an insecure default. This allowed any local user—not just administrators—to access the driver. A non-admin user could then capture network traffic or send arbitrary packets, potentially exposing sensitive data on the host or network.

Detection Guidance

Check if Npcap is installed with insecure access settings by verifying the driver permissions. Use the command 'sc qc npcap' to inspect the service configuration. Look for the 'Restrict Npcap driver's access to Administrators only' option in the Npcap installer settings.

Impact Analysis

This vulnerability could allow unauthorized users to capture network traffic, exposing sensitive information from your system or other devices on the same network. It may also enable attackers to send malicious packets, potentially disrupting network operations or launching further attacks.

Compliance Impact

This vulnerability could lead to unauthorized access to network traffic, potentially exposing sensitive data. This may violate compliance requirements under GDPR (data protection) and HIPAA (health information privacy) by allowing unauthorized users to capture or manipulate network data.

Mitigation Strategies

Reinstall Npcap with the 'Restrict Npcap driver's access to Administrators only' option enabled. Alternatively, upgrade Arc to version 2.7.0 or later to resolve the issue automatically.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-33921. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart