Skip to content
CVE Ledger
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API docsPage
  • MCP serverPage
  • AboutPage
  • Data sourcesPage
  • Data statusPage
  • ChangelogPage
  • How it's builtPage
  • Support the projectPage

14 results

Back

CVE-2026-33388Incorrect authorization in Credentials Manager in Guardian/CMC before 26.3.0

Description

An access control vulnerability was discovered in the Credentials Manager functionality due to insufficient validation of user privileges. A remote authenticated user with limited privileges can view a limited subset of the available entries in the Credentials Manager. The actual credential values are not directly visible, but the user can delete entries or edit their properties. An attacker who deletes or edits an entry can disrupt authentication for dependent devices, and one who manipulates an entry's configuration may be able to indirectly obtain the credentials.

Timeline

  1. ID reserved

    By Nozomi

  2. · 6 months later

    Published

  3. · 37 days later

    Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2026-33388, by who scored it
Scored byCVSSScoreVector
NozomiCNA (assigner)4.0Medium6.4CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:H/SI:L/SA:L
NozomiCNA (assigner)3.1High7.4CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
NVDNVD · Awaiting Analysis4.0Medium6.4CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS (exploitation in 30 days)
0.41% · top 64% of all CVEs (15 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: partial
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.4.

Affected products

What to do

Solution: Upgrade to v26.3.0 or later.

Workaround: Use internal firewall features to limit access to the web management interface.

Workaround: Review all accounts with access to it and delete unnecessary ones.

Workaround: Review the existing entries in the Credentials Manager for unauthorized modifications.

References

References2

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2026-33388 badge
[![CVE-2026-33388](https://cveledger.app/badge/CVE-2026-33388.svg)](https://cveledger.app/cve/CVE-2026-33388)

Record last updated .