CVE-2026-31985

highpriority · track · 0EPSS 0.002 · 10 %ileEUUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
0.20% (10th) EPSS
CVSS 8.1 · high
Is it mine?
3 products
Check your exposure
Who says so?
3 sources
cnnvd · enisa_euvd · nozomi_psirt

EPSS · scored 2026-10-22

When the upstream Guardian or CMC was configured in the Remote Collector via n2os-tui, the generated configuration disabled TLS certificate verification, and no option was provided to enable it. A malicious actor could perform a man-in-the-middle attack and intercept the communication between the Remote Collector and the Guardian or CMC. This could result in theft of the sync token, impersonation of the server, injection of spoofed data (such as false asset information or vulnerabilities) into the Guardian or CMC, or disruption of the data flow between the Remote Collector and the Guardian or CMC.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • FixedRemote Collectornozomi_psirt

    Upgrade Remote Collector to v26.2.0 or later.

  • MitigationRemote Collectornozomi_psirt

    Manually edit the "n2os.conf.user" file in the Remote Collector and remove the "!" prefix from the upstream Guardian or CMC endpoint entry to enable TLS certificate verification.

02

cvss

Technical severity, 0–10. One row per scoring source.

8.3
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 4.9–8.3

v3.18.1highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:Lsecondary · prodsec@nozominetworks.comexploitability 2.2 · impact 5.3
v3.18.1highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:Lsecondary · Nozomi Networks PSIRT
v4.08.3highCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:Nsecondary · ENISA EU
v4.08.3highCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · prodsec@nozominetworks.com
v4.04.9mediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)
03

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS
04

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-671USCWE-671US
05

affected products (3)

Products and version ranges known to be affected.

06

advisories (1)

Vendor and ecosystem advisories describing this.

  • NN-2026:12-01Disabled and non-configurable TLS certificate validation in n2os-tui when connecting the Remote Collector to a Guardian or CMC, in Remote Collector before v26.2.02026-07-07csaf · nozomi_psirtUS
07

also known as (3)

Other names and identifiers for this entity.

08

sources

Which sources assert this record, and when.

cnnvdenisa_euvdnozomi_psirtNVDCVE.orgMITRE
published 2026-07-09modified 2026-07-09
09

references (4)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan