CVE-2025-40896

Name of the Vulnerable Software and Affected Versions Arc versions (affected versions not specified)

Description A weakness exists where the server certificate is not verified when an Arc agent connects to a Guardian or CMC. This allows a malicious actor to perform a man-in-the-middle attack, potentially intercepting communication between the Arc agent and the Guardian or CMC. Successful exploitation could lead to theft of the client token and sensitive information, such as assets and alerts, server impersonation, or injection of spoofed data, like false asset information or vulnerabilities, into the Guardian or CMC.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.