A stored XSS flaw exists in the Assets and Nodes functionality of Nozomi Networks CMC and Guardian. The flaw arises from improper validation of a custom field input. An authenticated user with privileges to create custom fields can embed JavaScript payloads that are persisted. When a victim visits the Assets or Nodes pages, the malicious script runs within the victim’s browser context, enabling the attacker to perform actions on behalf of the user, including modifying application data, disrupting availability, and accessing limited sensitive information. This weakness is classified as CWE‑79.

Versions of Nozomi Networks CMC and Guardian earlier than 26.0.0 are affected. The vulnerability is present in the Assets and Nodes modules of these products.

The vulnerability carries a CVSS score of 7.1, indicating high severity. No EPSS score is available and the flaw is not listed in CISA’s KEV catalog, suggesting it has not yet been actively exploited in the wild. Exploitation requires an authenticated user with custom field creation rights to inject malicious content, after which any user who accesses the vulnerable pages triggers the payload. The attack vector is the browser, and the impact encompasses confidentiality, integrity, and availability of the application.