CVE-2026-33389: Smart Polling Auth Bypass Vulnerability

CVE-2026-33389 Overview

CVE-2026-33389 is an improper certificate and host key validation vulnerability in the Smart Polling functionality of Nozomi Networks sensors. The feature establishes encrypted connections to target devices without validating the remote host's identity, and no configuration option exists to enable validation. An attacker positioned between the sensor and a polled device can impersonate the endpoint during a polling session. The attacker intercepts communications and captures the credentials used for authentication. Those credentials can then be replayed against the original device or against other systems sharing the same credentials. The issue is categorized under [CWE-671: Lack of Administrator Control over Security].

Critical Impact
A man-in-the-middle attacker can intercept Smart Polling sessions, steal device credentials, and replay them to tamper with device data or disrupt operations.

Affected Products

Nozomi Networks products implementing Smart Polling functionality
See the vendor advisory for the specific product versions in scope
Refer to Nozomi Networks Security Advisory NN-2026:20-01 for the affected version list

Discovery Timeline

2026-09-08 - CVE-2026-33389 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-33389

Vulnerability Analysis

Smart Polling is designed to actively query field devices over encrypted channels to enrich passive monitoring data. The feature negotiates a Transport Layer Security (TLS) or Secure Shell (SSH) session with each polled device before submitting credentials. The vulnerability arises because the sensor accepts the remote endpoint's certificate or host key without verifying it against a trusted identity. There is also no administrator-facing option to require validation, which removes the ability to harden the deployment. An attacker on the network path can present an arbitrary certificate or SSH host key, complete the encrypted handshake, and receive the credentials the sensor was configured to submit. Because Smart Polling is typically configured with high-privilege service credentials, the captured secrets often unlock administrative access on the polled asset. In operational technology (OT) environments where the same credential is reused across similar devices, the attacker can pivot laterally to other assets using the same replayed secret.

Root Cause

The root cause is a missing trust anchor check during the encrypted handshake. The Smart Polling client trusts any certificate or host key presented by the peer and provides no configuration mechanism for administrators to enforce validation. This falls under improper certificate validation and is classified as [CWE-671].

Attack Vector

Exploitation requires network positioning between the sensor and a target polled device, such as an attacker on a compromised switch, router, or shared VLAN. The attacker intercepts the outbound polling connection, terminates it locally with an attacker-controlled certificate or host key, and forwards or drops traffic as needed. When the sensor authenticates, the attacker captures the credentials. The captured secrets are then replayed against the impersonated device or against other devices sharing the same credentials to read data, modify configuration, or disrupt operations.

No verified exploit code is publicly available. See the Nozomi Networks Security Advisory NN-2026:20-01 for vendor technical details.

Detection Methods for CVE-2026-33389

Indicators of Compromise

Unexpected TLS certificates or SSH host keys presented by polled devices, especially certificates that change between polling cycles without a planned rotation
Smart Polling sessions terminating at unexpected IP addresses or routed through unusual hops
Authentication events on polled devices originating from source addresses that do not match the sensor's IP
Reuse of polling service credentials on hosts that are not registered polling targets

Detection Strategies

Correlate sensor polling logs with device-side authentication logs to identify sessions that never reached the intended target
Monitor the network path between sensors and polled devices for Address Resolution Protocol (ARP) spoofing, rogue Dynamic Host Configuration Protocol (DHCP) responses, and unexpected Layer 2 topology changes
Alert on new or unknown TLS certificate fingerprints and SSH host key fingerprints observed on polling destinations

Monitoring Recommendations

Baseline the expected certificate and host key fingerprints for each polled device and alert on deviation
Continuously monitor OT network segments for man-in-the-middle indicators, including duplicate MAC addresses and Time-to-Live (TTL) anomalies
Audit service account activity to detect replay of polling credentials against systems outside the polling scope

How to Mitigate CVE-2026-33389

Immediate Actions Required

Apply the fixed version listed in Nozomi Networks Security Advisory NN-2026:20-01 as soon as it is available in your change window
Rotate any credentials configured for Smart Polling, and rotate the same credentials on any other device where they are reused
Restrict Smart Polling to dedicated, isolated network paths between the sensor and polled assets to reduce man-in-the-middle exposure
Enforce unique per-device credentials for polling so a single captured secret cannot unlock multiple assets

Patch Information

Refer to the Nozomi Networks Security Advisory NN-2026:20-01 for fixed versions and upgrade instructions. The advisory is the authoritative source for patched releases addressing CVE-2026-33389.

Workarounds

Segment sensors and polled devices onto dedicated management VLANs with strict access control lists to limit which hosts can sit on the polling path
Deploy Layer 2 protections such as Dynamic ARP Inspection and DHCP snooping on switches carrying polling traffic
Use unique, least-privilege service accounts per polled device to contain the impact of any single credential capture
Where feasible, disable Smart Polling until the patched version is deployed

bash

# Configuration example
# See Nozomi Networks Security Advisory NN-2026:20-01 for the vendor-supplied
# hardening and upgrade steps: https://security.nozominetworks.com/NN-2026:20-01