Medium severity · published Aug 11, 2026
CVE-2026-33922
Path traversal in the Offline archives functionality of the local web interface in Arc before v2.7.0
6.0
CVSS
0.2%
EPSS
No
On KEV
Description
A path traversal vulnerability was discovered in the Offline archives functionality of the local web interface due to insufficient validation of an input parameter. A local user with administrative credentials for the web interface could submit an archive name containing traversal sequences and delete arbitrary files reachable by the Arc process, which runs with administrative privileges on the host.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 6% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AR
Arc · Nozomi Networks
before 2.7.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-33922
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-33922
security.nozominetworks.com
https://security.nozominetworks.com/NN-2026:15-01
More from Arc
7.5
CVE-2026-33389
Disabled and non-configurable certificate/host key validation in Smart Polling in Guardian/CMC before 26.3.0 and Arc before v2.7.0
5.2
CVE-2026-33921
Npcap driver installed without administrator-only access restriction on Windows in Arc before v2.7.0
4.8
CVE-2025-40896
Lack of TLS certificate validation when connecting Arc to a Guardian or CMC, in Arc before v2.2.0