CVE-2025-40897: Nozomi Networks Cmc

High severity, CVSS 8.1. EPSS: 0.3% chance of exploitation in the next 30 days.

An access control vulnerability was discovered in the Threat Intelligence functionality due to a specific access restriction not being properly enforced for users with view-only privileges. An authenticated user with view-only privileges for the Threat Intelligence functionality can perform administrative actions on it, altering the rules configuration, and/or affecting their availability.

Affected products

• Nozomi Networks Cmc: before 26.0.0 (fixed in 26.0.0)
• Nozomi Networks Guardian: before 26.0.0 (fixed in 26.0.0)
• Siemens Ruggedcom APE1808: any version

Published 2026-04-15. Last modified 2026-06-17.