PT-2026-22916 · Arc+2 · Arc+2

Published 2026-03-04 · Updated 2026-03-05 · CVE-2025-40896

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Arc versions (affected versions not specified)

Description A weakness exists where the server certificate is not verified when an Arc agent connects to a Guardian or CMC. This allows a malicious actor to perform a man-in-the-middle attack, potentially intercepting communication between the Arc agent and the Guardian or CMC. Successful exploitation could lead to theft of the client token and sensitive information, such as assets and alerts, server impersonation, or injection of spoofed data, like false asset information or vulnerabilities, into the Guardian or CMC.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2025-40896

Affected Products

Arc

Cmc

Guardian

References · 4

• https://osv.dev/vulnerability/CVE-2025-40896 · Vendor Advisory
• https://security.nozominetworks.com/NN-2025:18-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-40896 · Security Note
• https://t.me/cveNotify/154371 · Telegram Post