Smart Polling Access Control Bypass in Nozomi Networks

Publication date: 2026-09-08

Last updated on: 2026-09-08

Assigner: Nozomi Networks Inc.

Description

An access control vulnerability was discovered in the Smart Polling configuration functionality due to insufficient validation of user privileges. An authenticated user with limited privileges can remotely bypass the intended access control of the web management interface and modify the Smart Polling discovery configuration. This allows the attacker to disrupt the visibility of assets in the monitored network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-08

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-33391

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This is an access control vulnerability in the Smart Polling configuration feature. It occurs because user privileges are not properly validated, allowing an authenticated user with limited access to bypass intended restrictions and modify the Smart Polling discovery settings remotely.

Impact Analysis

An attacker could exploit this to disrupt the visibility of assets in your monitored network by altering the Smart Polling discovery configuration. This may lead to incomplete or inaccurate asset tracking, potentially causing operational blind spots.

Mitigation Strategies

Immediately update the Smart Polling configuration functionality to enforce proper user privilege validation. Ensure only authorized users with sufficient privileges can modify discovery configurations. Review and restrict access to the web management interface to prevent unauthorized changes.

Hi! I’m here to help you understand CVE-2026-33391. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70