Security Resilience

CVE-2026-31985

Published
09 July 2026
Modified
25 October 2026
CVSS Score v4 8.3
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0020 10th percentile
Risk Priority 42 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). EPSS scores by FIRST (EPSS SIG), generated by Empirical Security. Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2026-31985 is a high-severity Lack of Administrator Control over Security (CWE-671) vulnerability in Nozominetworks (inferred from references). Its CVSS base score is 8.3 (High).

Operationally, ranked at the 10th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to CM-6 (Configuration Settings) and CM-7 (Least Functionality) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

When the upstream Guardian or CMC was configured in the Remote Collector via n2os-tui, the generated configuration disabled TLS certificate verification, and no option was provided to enable it. A malicious actor could perform a man-in-the-middle attack and intercept the…

more

communication between the Remote Collector and the Guardian or CMC. This could result in theft of the sync token, impersonation of the server, injection of spoofed data (such as false asset information or vulnerabilities) into the Guardian or CMC, or disruption of the data flow between the Remote Collector and the Guardian or CMC.

CWE(s)
CWE-671

Related Threats

CVEs Like This One

CVE-2025-24024Shared CWE-671
CVE-2026-33389Shared CWE-671
CVE-2023-20115Shared CWE-671

Affected Assets

Nozominetworks
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

CM-6 Configuration Settings good match

Mandating documented configuration settings that reflect restrictive modes directly requires the product to expose tunable security parameters to administrators.

CM-7 Least Functionality good match

Requiring configuration of least functionality forces the product to let administrators restrict or enable features rather than hard-coding them.

AC-6 Least Privilege partial match

Least-privilege assignment presupposes that administrators can grant or withhold specific privileges instead of having them fixed by the product.

Hardening callouts derived

DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.

  • No fine-grained STIG row for CWE-671, a class-level weakness, and none of its children carries one either.

References