A template injection vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter
At a glance
Low rather than Medium: exposure is scored at a default because we cannot see your systems or suppliers. If it touches your systems or suppliers, treat it as Medium.
Briefing
There is no written leader briefing for this story yet. These questions come from the facts we hold.
Questions to ask IT
- Are we affected by CVE-2026-33387, CVE-2026-33388 or 3 more, and which of our systems would be?
- If it is not yet patched, what mitigation is in place, and will the fix be done by 10 Dec?
Next steps
- Confirm whether this affects systems or suppliers in your estate
Vulnerability facts
Full CVE detail CVE-2026-33387- 5.1 · MediumExploitable over the network with a low-privilege account, but only if a user takes an action, such as opening a file or link. Low impact on integrity and availability.CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Not listed
- ~0.3% estimated chance of attack in 30 days
- Not linked from the CVE record
These facts are for CVE-2026-33387. This event covers 4 more CVEs, each with its own record.
No technical write-up beyond these facts and the summary below yet.
Next steps
- Review the advisory against your asset inventory and patch cadence
Summary
- View CSAF Summary Nozomi Networks has published information on vulnerabilities in Nozomi Guardian/CMC. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens recommends to contact customer support to receive patch and update information.
Read the original reportCISA Cybersecurity Advisories(opens in a new tab)
Pulse
Last change 1h ago · Next recheck 11 Nov 2026, 20:32 UK time
- Story3 Nov 2026, 12:04 UK time · 3 Nov
Linked reporting from CISA Cybersecurity Advisories (official authority).
Read source (CISA Cybersecurity Advisories) - Update10 Nov 2026, 20:32 UK time · 1h ago
moved from Medium to Low. Suggested changed to 30d.
- Story10 Nov 2026, 20:33 UK time · 1h ago
Linked reporting from CISA ICS Advisories (official authority).
Read source (CISA ICS Advisories)
3 entries so far. The timeline chart appears once this story has more history.
Sources
- CISA Cybersecurity AdvisoriesOfficial
Siemens RUGGEDCOM APE1808 Devices
- CISA ICS AdvisoriesOfficial
Siemens RUGGEDCOM APE1808 Devices
How we know
Statements extracted from sources. Higher confidence means stronger corroboration.
- ClaimedHeadline60% confidence
A template injection vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter
- ProbableSummary fact75% confidence
View CSAF Summary Nozomi Networks has published information on vulnerabilities in Nozomi Guardian/CMC. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens recommends to contact customer support to receive patch and update information.
- ConfirmedCVE identifier95% confidence
Event involves CVE-2026-33387
- ConfirmedCVE identifier95% confidence
Event involves CVE-2026-33388
- ConfirmedCVE identifier95% confidence
Event involves CVE-2026-33389
- ConfirmedCVE identifier95% confidence
Event involves CVE-2026-33391
- ConfirmedCVE identifier95% confidence
Event involves CVE-2026-33920