A stored HTML injection flaw exists in the Schedule Restore Archive feature of Nozomi Networks' CMC and Guardian platforms. The flaw arises from improper validation of an input parameter, allowing an authenticated administrator to embed malicious HTML tags into a restore schedule. When a victim views the schedule, the injected HTML renders in their browser, potentially facilitating phishing or open redirect attacks. Full XSS exploitation and direct information disclosure are mitigated by existing content security policies and input validation, but the injected content still poses a usability‑based threat.

Nozomi Networks CMC and Guardian versions earlier than v26.1.0 are affected, regardless of deployment size or location.

The CVSS score of 4.8 indicates moderate risk. Exploitation requires an authenticated user with administrative privileges, and no public exploitation evidence exists. The likely attack vector is inferred to be authenticated remote access to the web management interface, which is typically restricted to trusted administrators. Because the vulnerability is not exploitable without admin credentials, the practical exploitation risk is lower than high‑severity vulnerabilities but still significant for organizations with broad admin access.