CVE-2026-33391: Incorrect authorization in Smart Polling configuration in Guardian/CMC before 26.3.0
An access control vulnerability was discovered in the Smart Polling configuration functionality due to insufficient validation of user privileges. An authenticated user with limited privileges can remotely bypass the intended access control of the web management interface and modify the Smart Polling discovery configuration. This allows the attacker to disrupt the visibility of assets in the monitored network.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Guardian/CMC Smart Polling configurationto a version that resolves this vulnerability.Fixed in 26.3.0 - Compensating control
Restrict access to the web management interface so only authorized administrators can reach Smart Polling configuration functionality, reducing the chance that a limited-privilege authenticated user can exploit the authorization bypass.
Event History
Frequently Asked Questions
Which deployments are affected?
OpenText Guardian/CMC versions before 26.3.0 are affected. Exploitation targets the web management interface's Smart Polling configuration functionality.
What access does an attacker need?
The attacker must be authenticated with a limited-privilege account and able to reach the web management interface remotely. No user interaction is required.
What could an attacker change or disrupt?
An attacker can bypass intended authorization controls to modify Smart Polling discovery configuration. This can disrupt visibility of assets on the monitored network.