Vulnerabilities

TI-2026-26277 CVE-2026-33920 · GHSA-ccg2-64fc-r6w8

Cross-site request forgery in the Guardian/CMC login before 26.3.0

LOW 22

A cross-site request forgery vulnerability was discovered in the login functionality (both standard and SAML) due to missing validation of the anti-CSRF token.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00136 Published 2026-09-08 Fixed in 26.3.0 CWE-352

TI-2026-25788 CVE-2026-33391 · GHSA-jx7f-4jrv-rjh9

Incorrect authorization in Smart Polling configuration in Guardian/CMC before 26.3.0

LOW 24

An access control vulnerability was discovered in the Smart Polling configuration functionality due to insufficient validation of user privileges.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00355 Published 2026-09-08 Fixed in 26.3.0 CWE-863

TI-2026-25786 CVE-2026-33389 · GHSA-8g88-35qx-36v7

Disabled and non-configurable certificate/host key validation in Smart Polling in…

LOW 23

An improper certificate/host key validation vulnerability was discovered in the Smart Polling functionality, which established encrypted connections to target devices without validating the remote host's identity, and no…

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00167 Published 2026-09-08 Fixed in 26.3.0, 2.7.0 CWE-671

TI-2026-25785 CVE-2026-33388 · GHSA-6rjw-mcjc-47ch

Incorrect authorization in Credentials Manager in Guardian/CMC before 26.3.0

LOW 29

An access control vulnerability was discovered in the Credentials Manager functionality due to insufficient validation of user privileges.

CVSS 4.0MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00413 Published 2026-09-08 Fixed in 26.3.0 CWE-863

TI-2026-25784 CVE-2026-33387 · GHSA-xp2q-mg9h-jmmm

Insufficient sanitization of Dashboards in Guardian/CMC before 26.3.0