PT-2026-22916 · Arc+2 · Arc+2

Publicado 2026-03-04 · Atualizado 2026-03-05 · CVE-2025-40896

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Arc versions (affected versions not specified)

Description A weakness exists where the server certificate is not verified when an Arc agent connects to a Guardian or CMC. This allows a malicious actor to perform a man-in-the-middle attack, potentially intercepting communication between the Arc agent and the Guardian or CMC. Successful exploitation could lead to theft of the client token and sensitive information, such as assets and alerts, server impersonation, or injection of spoofed data, like false asset information or vulnerabilities, into the Guardian or CMC.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2025-40896

Produtos afetados

Arc

Cmc

Guardian

Referências · 4

• https://osv.dev/vulnerability/CVE-2025-40896 · Aviso do Fabricante
• https://security.nozominetworks.com/NN-2025:18-01 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-40896 · Nota de Segurança
• https://t.me/cveNotify/154371 · Publicação no Telegram