Vulnerability in Nozomi Networks Arc
CVE-2025-40896
The server certificate was not verified when an Arc agent connected to a Guardian or CMC. A malicious actor could perform a man-in-the-middle attack and intercept the communication between the Arc agent and the Guardian or CMC. This could result in theft of the client token and sensitive information (such as assets and alerts), impersonation of the server, or injection of spoofed data (such as false asset information or vulnerabilities) into the Guardian or CMC.
Vulnerability class: Improper Certificate Validation
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.001 (1.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 1st percentile — 1.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.001 · newest: 0.001 · change: 0.000
Affected products
- Nozomi Networks Arc — versions 0
- Nozominetworks Arc
Weakness classification (CWE)
References
- security.nozominetworks.com/NN-2025:18-01 (Vendor Advisory)
Frequently asked questions
- What is CVE-2025-40896?
- CVE-2025-40896 is a medium-severity vulnerability in Nozomi Networks Arc, classified under Improper Certificate Validation. CVSS score: 6.5/10. Published 2026-03-04.
- How severe is CVE-2025-40896?
- Medium severity. CVSS v3 base score is 6.5 out of 10.