A stored HTML injection flaw exists in the Credentials Manager of Nozomi Networks CMC and Guardian. An authenticated administrator can embed malicious HTML tags into an identity record. When a user attempts to delete that identity, the injected markup renders in the victim’s browser, enabling phishing or open redirect attacks while full script execution and direct data theft are blocked by existing input validation and a Content Security Policy.

The vulnerability affects Nozomi Networks CMC and Guardian versions prior to 26.1.0. Any deployment using 26.0 or earlier is susceptible until upgraded.

The CVSS score of 4.8 reflects moderate severity; the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated administrator with access to the web management interface, which is typically an internal network function. Once an attacker creates a malicious identity, any user who deletes that identity will be exposed to the injected content. The overall risk is moderate, but it remains a concern for organizations that rely on native client or browser-based authentication flows.