A stored HTML injection vulnerability exists in the Users feature of Nozomi Networks CMC and Guardian when an administrator creates a user whose username contains HTML tags. The injected markup renders only when a victim deletes a group that includes this user, enabling phishing or possibly open redirect attacks. The vulnerability is an input validation flaw mapped to CWE‑79, and full XSS exploitation and direct information disclosure are mitigated by the product’s existing input validation and Content Security Policy.

All installations of Nozomi Networks CMC and Guardian with a version earlier than 26.1.0 are affected, provided that administrative users can create or edit user accounts.

The CVSS score of 4.8 indicates a low‑to‑moderate risk. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting a low probability of widespread exploitation. The attack path requires a legitimate administrative account to create the malicious user, and the harmful effect only manifests when another user attempts to delete a group containing that user. Consequently, the risk is confined to scenarios involving group deletion by users who will view the injected content.