Get real-time updates on Telegram
CVE-2026-33922: Arc 0 to before 2.7.0
CVE-2026-33922. CVSS 3.1 base score 6.0 (MEDIUM, Vendor/CNA). EPSS 0.00166 (percentile 0.05584), scored 22-Oct-2026.
Affected technology
Arc · 0 to before 2.7.0
Nozomi Networks
Component: Not specified by the source
Attack conditions (Vendor/CNA, CVSS 4.0): Local · High privileges required · No user interaction required
What an attacker can do
A local user with administrative credentials for the web interface could submit an archive name containing traversal sequences and delete arbitrary files reachable by the Arc process, which runs with administrative privileges on the host. Vendor/CNA’s CVSS 4.0 assessment (base score 6.8/10) rates confidentiality impact as none; integrity and availability impact as high.
- CWE
- CWE-22
- CCR priority
- 24.0 /100 (P4)
- CVSS 3.1
- 6.0 /10 · CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H · Vendor/CNA
- EPSS
- 0.00166 · percentile 0.05584 · 2026-10-22
- KEV
- no
Provenance
- NVD CVE API 2.0 · Source record · observed 2026-10-24 01:40:49.068977+00:00 UTC
Stable permalink: https://cybercodered.org/item/cve-cve-2026-33922.html