CVE-2026-33391: Smart Polling Auth Bypass Vulnerability

CVE-2026-33391 Overview

CVE-2026-33391 is a broken access control vulnerability [CWE-863] in the Smart Polling configuration functionality of a Nozomi Networks product. The web management interface fails to properly validate user privileges before accepting configuration changes. An authenticated attacker with low-privilege credentials can remotely modify Smart Polling discovery settings. This disrupts asset visibility across the monitored network and degrades operational monitoring of the environment.

Critical Impact
An authenticated low-privilege user can remotely alter Smart Polling discovery configuration, disrupting asset visibility across monitored networks.

Affected Products

Nozomi Networks products exposing the Smart Polling configuration feature (see vendor advisory for affected versions)
Web management interface component handling Smart Polling discovery configuration
Deployments where low-privilege user accounts are provisioned on the management interface

Discovery Timeline

2026-09-08 - CVE-2026-33391 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-33391

Vulnerability Analysis

The vulnerability resides in the Smart Polling configuration functionality of the web management interface. Smart Polling is used to actively query devices for asset discovery and monitoring. The interface exposes configuration endpoints that modify polling behavior, targets, and scope. These endpoints do not enforce an authorization check aligned with the caller's privilege level.

An authenticated user with limited privileges can invoke these configuration endpoints and alter the discovery configuration. The impact is degraded operational visibility: modified polling scope can cause assets to disappear from monitoring views. This undermines the platform's role as an operational technology (OT) and IoT visibility tool.

The CWE-863 classification identifies the flaw as incorrect authorization, distinct from missing authentication. The application recognizes the session but fails to compare the requested action against the user's role.

Root Cause

The root cause is insufficient validation of user privileges on the Smart Polling configuration handlers. Authorization logic either omits a role check or applies a check that does not cover the configuration modification path. As a result, the enforcement boundary between read-only or limited roles and configuration-capable roles is not honored on this feature.

Attack Vector

The attack vector is network-based over the web management interface. An attacker must first hold valid credentials for a low-privilege account. Using those credentials, the attacker issues an authenticated request to the Smart Polling configuration endpoint with modified discovery parameters. No user interaction is required beyond the attacker's own authenticated session. Refer to the Nozomi Networks Security Advisory for technical detail on the affected endpoint and request flow.

Detection Methods for CVE-2026-33391

Indicators of Compromise

Unexpected changes to Smart Polling discovery configuration, including added, removed, or modified polling targets and scopes.
Audit log entries showing low-privilege accounts issuing configuration-change requests against the Smart Polling feature.
Sudden drops in the count of discovered or monitored assets without corresponding network changes.
Authentication events from low-privilege accounts followed by administrative-style API calls on the management interface.

Detection Strategies

Correlate management interface audit logs with user role assignments to flag configuration changes performed by non-administrative accounts.
Baseline the Smart Polling configuration and alert on deviation of polling ranges, credentials, or schedules.
Track sequences where a low-privilege session accesses configuration endpoints normally reserved for administrators.

Monitoring Recommendations

Forward management interface audit logs to a centralized SIEM and retain them for post-incident review.
Monitor asset inventory counts as a health metric and alert on abrupt reductions.
Review privileged operation logs on the appliance daily until the patched release is deployed.

How to Mitigate CVE-2026-33391

Immediate Actions Required

Apply the vendor-supplied patch referenced in the Nozomi Networks Security Advisory as soon as it is available for your version.
Audit user accounts on the web management interface and remove or downgrade accounts that no longer require access.
Rotate credentials for low-privilege accounts if any suspicious configuration activity is observed.
Snapshot the current Smart Polling configuration so tampering can be detected and reverted.

Patch Information

Refer to the Nozomi Networks Security Advisory NN-2026:17-01 for fixed version information and upgrade instructions. Apply the vendor's fixed release to restore correct privilege validation on Smart Polling configuration endpoints.

Workarounds

Restrict network access to the web management interface to trusted administrative networks only.
Limit issuance of interactive accounts on the appliance to personnel with an operational need.
Review the Smart Polling configuration on a defined schedule and reconcile against a known-good baseline until patched.

bash

# Configuration example: restrict management interface exposure at the network layer
# Replace 10.0.0.0/24 with the administrative subnet authorized to reach the appliance
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP