CVE-2026-31984: Nozomi Networks CMC & Guardian Unbound Audit Logging DoS

Technical summary

CVE-2026-31984 is a CWE-770 (Allocation of Resources Without Limits or Throttling) vulnerability affecting the audit logging subsystem. The flaw stems from missing input size validation on audit entry data. When an attacker sends requests with excessively large payloads, the logging mechanism records the entire input without enforcing bounds, leading to exhaustion of available disk space. The vulnerability is network-accessible, requires no authentication or user interaction, and has a CVSS 3.1 score of 7.5 (HIGH) with complete impact on availability (A:H).

Business impact

This vulnerability poses a significant operational risk by enabling remote attackers to degrade or disable critical infrastructure monitoring. Organizations relying on Nozomi Networks CMC or Guardian for industrial control system visibility could face extended downtime, loss of situational awareness during an outage, and potential cascade effects if security teams cannot access audit logs during active incidents. The attack requires no specialized knowledge or credentials, making it a low-barrier-to-entry denial-of-service vector.

Affected systems

The vulnerability affects Nozomi Networks CMC and Nozomi Networks Guardian. All versions lacking the fix are considered vulnerable. Organizations running these products should verify their deployment versions against vendor patch advisories to determine exposure scope.

Exploitability

Exploitability is high. The vulnerability requires only network access and unauthenticated requests—no credentials, client-side components, or user interaction needed. An attacker can exploit this remotely and repeatedly. The attack surface is the audit logging endpoint itself, which processes ingress traffic. CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H reflects this simplicity: network-accessible, low attack complexity, no privileges required, no user interaction, and high availability impact.

Remediation

Apply patches from Nozomi Networks as soon as they become available. Interim mitigations include restricting network access to audit logging endpoints via firewall rules or network segmentation, implementing rate limiting or request size caps at the network perimeter, and monitoring disk space utilization on affected systems for anomalous consumption patterns. Log aggregation and off-system backup of critical audit data can also reduce impact if local disk exhaustion occurs.

Patch guidance

Contact Nozomi Networks or consult their security advisories for patched versions of CMC and Guardian. When patches are released, prioritize deployment to systems exposed to untrusted networks. After patching, verify that audit logging functionality operates normally and that disk space consumption returns to baseline levels. Test in a non-production environment first to ensure compatibility with your deployment.

Detection guidance

Monitor for sudden or sustained increases in disk space consumption on CMC and Guardian systems, particularly in audit log directories. Correlate disk growth with network traffic patterns to identify anomalous request sizes. Examine audit logs for entries containing unusually large payloads or repeated submissions of oversized requests. Network-level detection should flag requests to audit logging endpoints with exceptionally large body sizes. Set thresholds based on your typical audit entry size distribution and alert when outliers appear.

Why prioritize this

This vulnerability merits high priority despite not yet appearing on CISA's Known Exploited Vulnerabilities catalog. The combination of unauthenticated network accessibility, low attack complexity, and guaranteed availability impact makes it an attractive target for disruption campaigns. Industrial control system products are frequently targeted by nation-states and criminal groups. Nozomi Networks products provide critical visibility into OT/ICS environments; their degradation or compromise directly undermines situational awareness during security incidents. Rapid patching limits the window for exploitation.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) correctly reflects high exploitability and high impact. The attack vector (network), attack complexity (low), and privilege requirements (none) all favor attackers. The vulnerability does not affect confidentiality or integrity but completely compromises availability—a critical concern in industrial environments where monitoring downtime equals blindness. The score does not account for the ICS/OT context, which amplifies real-world risk beyond the numeric baseline.

Frequently asked questions