A stored HTML injection flaw in the Smart Polling feature allows an authenticated user with limited credentials to submit malicious remote strategies containing HTML tags. When other users view the affected strategy, the injected HTML renders in their browsers, creating opportunities for phishing or open‑redirect attacks. Existing input validation and the host’s Content Security Policy prevent full cross‑site scripting or direct information disclosure.

Nozomi Networks CMC and Guardian products, all versions prior to 26.1.0, are vulnerable.

The CVSS score of 5.1 indicates a moderate impact level. The exploit requires authentication but is otherwise straightforward due to the lack of advanced privilege escalation requirements. Because the vulnerability is not listed in CISA’s KEV catalog and no EPSS score is available, it is not known to be actively exploited in the wild, yet it remains a legitimate risk for exposed or internal networks where users may view synced strategies.