CVE-2026-33923Published

Update bundle signature bypass in Guardian/CMC before 26.4.0

Exact source revision recorded 29 Oct 2026 14:12:12 UTC. It does not establish the source's current position. Latest evidence.

Recorded JSON

cve-program · CVE-2026-33923

Published

A signature verification vulnerability was discovered in the update installation functionality due to inconsistent validation of the update bundle contents. An attacker with administrative privileges can remotely supply a crafted update bundle that passes signature verification but runs an unsigned script when the bundle is installed. The script runs with root privileges, allowing the attacker to read or modify sensitive data, change the appliance configuration, or shut down the appliance.

Source published: 29 Oct 2026 10:46:27 UTC
Source modified: 29 Oct 2026 12:36:53 UTC
Observed here: 29 Oct 2026 14:12:12 UTC
Source terms: CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · 7.5 CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1 · 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H