CVE-2026-33922: Path Traversal Vulnerability in Arc

CVE-2026-33922 Overview

CVE-2026-33922 is a path traversal vulnerability [CWE-22] in the Offline archives functionality of a local web interface. The flaw stems from insufficient validation of an input parameter that accepts an archive name. An authenticated administrator can submit an archive name containing directory traversal sequences to delete arbitrary files on the host. The affected Arc process runs with administrative privileges, so deleted files are not limited to user-writable locations. Nozomi Networks published the advisory tracking this issue as NN-2026:15-01.

Critical Impact
An authenticated local administrator can delete arbitrary files reachable by the Arc process, which executes with administrative privileges, resulting in integrity and availability loss on the affected host.

Affected Products

Nozomi Networks product exposing the Offline archives functionality via the local web interface (see vendor advisory NN-2026:15-01)
Specific product names and version ranges are documented in the Nozomi Networks Security Advisory

Discovery Timeline

2026-08-11 - CVE-2026-33922 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-33922

Vulnerability Analysis

The vulnerability resides in the Offline archives feature exposed by the local web interface. When a user submits an archive-related request, the backend consumes an archive name parameter without normalizing or constraining the path. An authenticated administrator can supply a value containing traversal sequences such as ../ to escape the intended archive directory. The application then passes the attacker-controlled path to a file deletion routine executed by the Arc process.

Because Arc runs with administrative privileges, deletion succeeds against any file the operating system permits the account to remove. Attackers can target configuration files, log data, service binaries, or dependencies required by the host application. The result is loss of integrity and availability, mapped to VI:H and VA:H in the CVSS 4.0 vector.

Root Cause

The root cause is missing input sanitization on the archive name parameter. The application does not enforce a canonicalized base directory, reject .. sequences, or validate that the resulting path resides within an allowlisted archive location. This is a textbook path traversal weakness under [CWE-22].

Attack Vector

Exploitation requires local access to the web interface and valid administrative credentials. The attacker authenticates to the local web interface, invokes the Offline archives function, and submits a crafted archive name that traverses outside the archive directory. The privileged Arc process performs the delete operation on behalf of the request. No user interaction beyond the authenticated session is required. See the Nozomi Networks Security Advisory for vendor-provided technical detail.

Detection Methods for CVE-2026-33922

Indicators of Compromise

Web interface request logs containing archive name parameters with ../, ..\, URL-encoded %2e%2e%2f, or absolute path prefixes
Unexpected file deletion events attributed to the Arc process outside its normal archive directory
Administrative session activity from local accounts immediately preceding missing configuration, log, or binary files

Detection Strategies

Enable verbose request logging on the local web interface and alert on archive-related endpoints containing traversal metacharacters
Correlate file deletion telemetry from the host with authenticated web interface sessions to identify privileged deletions initiated through the archive workflow
Monitor the integrity of directories outside the archive path that should never be modified by the Arc process

Monitoring Recommendations

Audit local administrator logins to the web interface and flag deviations from expected operator schedules
Track process activity for Arc and alert on file removal operations outside its documented working directories
Retain and centralize web interface access logs so post-incident analysis can reconstruct archive parameter values

How to Mitigate CVE-2026-33922

Immediate Actions Required

Apply the fixed version listed in the Nozomi Networks Security Advisory as soon as it is available for your deployment
Restrict access to the local web interface to trusted operator networks and hardened jump hosts
Rotate credentials for all web interface administrator accounts and remove unused administrative accounts

Patch Information

Refer to the vendor advisory NN-2026:15-01 for fixed release versions and upgrade instructions. The Nozomi Networks Security Advisory is the authoritative source for patch availability, remediation guidance, and any product-specific caveats.

Workarounds

Limit administrative credentials for the local web interface to a minimal set of named operators
Enforce network segmentation so the local web interface is unreachable from general-purpose user networks
Enable and review web interface audit logging to detect misuse of the Offline archives function until the patch is deployed

bash

# Example: restrict access to the local web interface using host firewall rules
# Replace <mgmt_subnet> with the trusted management network CIDR
iptables -A INPUT -p tcp --dport 443 -s <mgmt_subnet> -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP