CVE-2026-33921

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33921", "assignerOrgId": "bec8025f-a851-46e5-b3a3-058e6b0aa23c", "state": "PUBLISHED", "assignerShortName": "Nozomi", "dateReserved": "2026-03-24T16:06:11.950Z", "datePublished": "2026-08-11T09:48:20.211Z", "dateUpdated": "2026-08-11T14:15:15.632Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "bec8025f-a851-46e5-b3a3-058e6b0aa23c", "shortName": "Nozomi", "dateUpdated": "2026-08-11T09:48:20.211Z"}, "title": "Npcap driver installed without administrator-only access restriction on Windows in Arc before v2.7.0", "datePublic": "2026-08-11T07:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-1188", "description": "CWE-1188 Initialization of a resource with an insecure default", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"}]}], "affected": [{"vendor": "Nozomi Networks", "product": "Arc", "platforms": ["Windows"], "versions": [{"status": "affected", "version": "0", "lessThan": "2.7.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:nozomi_networks:arc:*:*:*:*:*:windows:*:*", "versionStartIncluding": "0", "versionEndExcluding": "2.7.0"}]}]}], "descriptions": [{"lang": "en", "value": "The Windows installer deployed Npcap leaving its access restriction option at the insecure default value, so the driver was accessible to every local user of the host instead of being restricted to administrators only. A local user without administrative privileges could use the Npcap driver to capture the traffic reaching the host, which discloses information belonging both to the host and to other systems on the same network segment, and to send arbitrary raw packets on that segment.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "The Windows installer deployed Npcap leaving its access restriction option at the insecure default value, so the driver was accessible to every local user of the host instead of being restricted to administrators only. A local user without administrative privileges could use the Npcap driver to capture the traffic reaching the host, which discloses information belonging both to the host and to other systems on the same network segment, and to send arbitrary raw packets on that segment."}]}], "references": [{"url": "https://security.nozominetworks.com/NN-2026:14-01"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "subConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 4.8, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 5.2, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "workarounds": [{"lang": "en", "value": "Reinstall Npcap on the affected host with the \"Restrict Npcap driver's access to Administrators only\" option enabled.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Reinstall Npcap on the affected host with the &quot;Restrict Npcap driver's access to Administrators only&quot; option enabled.<br>"}]}], "solutions": [{"lang": "en", "value": "Upgrade Arc to v2.7.0 or later.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Upgrade Arc to v2.7.0 or later.<br>"}]}], "credits": [{"lang": "en", "value": "This issue was found by Stefano Balzarotti of Nozomi Networks during an internal investigation.", "type": "finder"}], "source": {"discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-11T14:15:00.867656Z", "id": "CVE-2026-33921", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-11T14:15:15.632Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33921", "assignerOrgId": "bec8025f-a851-46e5-b3a3-058e6b0aa23c", "state": "PUBLISHED", "assignerShortName": "Nozomi", "dateReserved": "2026-03-24T16:06:11.950Z", "datePublished": "2026-08-11T09:48:20.211Z", "dateUpdated": "2026-08-11T14:15:15.632Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "bec8025f-a851-46e5-b3a3-058e6b0aa23c", "shortName": "Nozomi", "dateUpdated": "2026-08-11T09:48:20.211Z"}, "title": "Npcap driver installed without administrator-only access restriction on Windows in Arc before v2.7.0", "datePublic": "2026-08-11T07:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-1188", "description": "CWE-1188 Initialization of a resource with an insecure default", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"}]}], "affected": [{"vendor": "Nozomi Networks", "product": "Arc", "platforms": ["Windows"], "versions": [{"status": "affected", "version": "0", "lessThan": "2.7.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:nozomi_networks:arc:*:*:*:*:*:windows:*:*", "versionStartIncluding": "0", "versionEndExcluding": "2.7.0"}]}]}], "descriptions": [{"lang": "en", "value": "The Windows installer deployed Npcap leaving its access restriction option at the insecure default value, so the driver was accessible to every local user of the host instead of being restricted to administrators only. A local user without administrative privileges could use the Npcap driver to capture the traffic reaching the host, which discloses information belonging both to the host and to other systems on the same network segment, and to send arbitrary raw packets on that segment.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "The Windows installer deployed Npcap leaving its access restriction option at the insecure default value, so the driver was accessible to every local user of the host instead of being restricted to administrators only. A local user without administrative privileges could use the Npcap driver to capture the traffic reaching the host, which discloses information belonging both to the host and to other systems on the same network segment, and to send arbitrary raw packets on that segment."}]}], "references": [{"url": "https://security.nozominetworks.com/NN-2026:14-01"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "subConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 4.8, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 5.2, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "workarounds": [{"lang": "en", "value": "Reinstall Npcap on the affected host with the \"Restrict Npcap driver's access to Administrators only\" option enabled.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Reinstall Npcap on the affected host with the &quot;Restrict Npcap driver's access to Administrators only&quot; option enabled.<br>"}]}], "solutions": [{"lang": "en", "value": "Upgrade Arc to v2.7.0 or later.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Upgrade Arc to v2.7.0 or later.<br>"}]}], "credits": [{"lang": "en", "value": "This issue was found by Stefano Balzarotti of Nozomi Networks during an internal investigation.", "type": "finder"}], "source": {"discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33921", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-11T14:15:00.867656Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-11T14:15:12.262Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["Windows"], "product": "Arc", "vendor": "Nozomi Networks", "versions": [{"lessThan": "2.7.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "prodsec@nozominetworks.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Windows installer deployed Npcap leaving its access restriction option at the insecure default value, so the driver was accessible to every local user of the host instead of being restricted to administrators only. A local user without administrative privileges could use the Npcap driver to capture the traffic reaching the host, which discloses information belonging both to the host and to other systems on the same network segment, and to send arbitrary raw packets on that segment."}, {"lang": "es", "value": "El instalador de Windows despleg\u00f3 Npcap dejando su opci\u00f3n de restricci\u00f3n de acceso en el valor predeterminado inseguro, por lo que el controlador era accesible para cada usuario local del host en lugar de estar restringido solo a administradores. Un usuario local sin privilegios administrativos podr\u00eda usar el controlador Npcap para capturar el tr\u00e1fico que llega al host, lo que divulga informaci\u00f3n perteneciente tanto al host como a otros sistemas en el mismo segmento de red, y para enviar paquetes sin procesar arbitrarios en ese segmento."}], "id": "CVE-2026-33921", "lastModified": "2026-10-23T19:10:00.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 2.7, "source": "prodsec@nozominetworks.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "prodsec@nozominetworks.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33921", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-11T14:15:00.867656Z", "version": "2.0.3"}}]}, "published": "2026-08-11T10:17:11.963", "references": [{"source": "prodsec@nozominetworks.com", "url": "https://security.nozominetworks.com/NN-2026:14-01"}], "sourceIdentifier": "prodsec@nozominetworks.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1188"}], "source": "prodsec@nozominetworks.com", "type": "Secondary"}]}

{"bugzilla": {"description": "Nozomi Networks Arc: Npcap Driver: Information disclosure and arbitrary packet sending via insecure access restrictions", "id": "2513846", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513846"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.2", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-1188", "details": ["A flaw was found in the Npcap driver. The Windows installer for Arc deployed Npcap with insecure default access restrictions, allowing any local user, not just administrators, to access the driver. This vulnerability enables a local user without administrative privileges to capture network traffic, leading to information disclosure from the host and other systems on the same network segment. Additionally, the user can send arbitrary raw packets on that segment."], "name": "CVE-2026-33921", "public_date": "2026-08-11T09:48:20Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-33921\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-33921\nhttps://security.nozominetworks.com/NN-2026:14-01"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": ["windows"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,2.7.0)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Arc", "source": "cna", "vendor": "Nozomi Networks"}, "product": "arc", "vendor": "nozomi_networks"}], "created": "2026-08-11T11:45:04.089549+00:00", "updated": "2026-08-11T12:30:09.235145+00:00", "vendors": ["nozomi_networks", "nozomi_networks$PRODUCT$arc"]}