CVE-2025-40896 Lack of TLS certificate validation when connecting Arc to a Guardian or CMC, in Arc before v2.2.0
Attackers can intercept Arc agent communications via man-in-the-middle attacks due to missing TLS validation, stealing tokens and injecting spoofed data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-40896?
CVE-2025-40896 is a medium-severity vulnerability in Nozomi Networks Arc, published on 4 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The server certificate was not verified when an Arc agent connected to a Guardian or CMC.
A malicious actor could perform a man-in-the-middle attack and intercept the communication between the Arc agent and the Guardian or CMC. This could result in theft of the client token and sensitive information (such as assets and alerts), impersonation of the server, or injection of spoofed data (such as false asset information or vulnerabilities) into the Guardian or CMC.
Weakness: CWE-295
Which versions are affected by CVE-2025-40896?
It affects 1 product.
Products include Nozominetworks Arc.
How do I fix CVE-2025-40896?
No fix has been published for CVE-2025-40896 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-40896 being exploited?
There is no known exploitation of CVE-2025-40896 in the wild and no public exploit code.
Sources
Also known as GHSA-32r6-gffx-pj25.