Skip to contentNozomi Networks Arc vulnerabilities
- basekick-labs arcArc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735CVE-2026-55098Fix available6.5 Medium
- nozomi networks arcAddress Bar Spoof Risk; Missing Fullscreen Notification via Select ElementCVE-2026-941817.4 High
- hashgraph guardian, nozomi networks arc, cmc +1 more +3 moreDisabled and non-configurable certificate/host key validation in Smart Polling in Guardian/CMC before 26.3.0 and Arc before v2.7.0CVE-2026-333895.3 Medium
- basekick-labs arcArc: Unauthenticated cluster node admission when `cluster.shared_secret` is unsetCVE-2026-55678Fix available6.9 Medium
- basekick-labs arcArc Enterprise cluster replication accepts unauthenticated MsgReplicateSync messages, enabling cluster-wide data injection from any TLS-trusted peerCVE-2026-481068.3 High
- basekick-labs arcArc Enterprise cluster FSM applyRegisterFile accepts arbitrary file paths without validation, enabling cluster-wide path-traversal worm primitiveCVE-2026-481058.3 High
- nozomi networks arcPath traversal in the Offline archives functionality of the local web interface in Arc before v2.7.0CVE-2026-339226.8 Medium
- nozomi networks arcNpcap driver installed without administrator-only access restriction on Windows in Arc before v2.7.0CVE-2026-339214.8 Medium
- basekick-labs arcArc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoSCVE-2026-48050Fix available8.8 High
- basekick-labs arcArc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checksCVE-2026-47735Fix available7.1 High
- nozomi networks arcLack of TLS certificate validation when connecting Arc to a Guardian or CMC, in Arc before v2.2.0CVE-2025-408966.3 Medium
- nozomi networks arcPath traversal via 'zip slip' in Arc before v1.6.0CVE-2023-59388.9 High
- nozomi networks arcSensitive data exfiltration via unsafe permissions on Windows systems in Arc before v1.6.0CVE-2023-59375.2 Medium
- nozomi networks arcUnsafe temporary data privileges on Unix systems in Arc before v1.6.0CVE-2023-59367.3 High
- nozomi networks arcMissing authentication for local web interface in Arc before v1.6.0CVE-2023-59357.3 High
- cdata arcA path traversal vulnerability exists in the Java version of CData Arc < 23.4.8839 when running...CVE-2024-318508.6 High