CISA Malcolm
CISA patched high-severity Malcolm flaws through version 26.08.0, including authentication bypass and SSRF.
CISA advisory ICSA-26-280-01 covers its Malcolm network-analysis tool, with versions through 26.07.1 affected and fixes in 26.08.0. Seven CVEs are listed, and the highest stated CVSS v3.1 score is 8.1. The described issues include authentication bypass, role-check bypass, SSRF in the FilePond upload component, direct access to Arkime, and CSRF against the kiosk app. Malcolm is used worldwide in energy, IT, and water sectors; the advisory does not report active exploitation.
- Malcolm 26.07.1 and earlier are affected; fixes are in 26.08.0.
- Seven CVEs are listed, with a top CVSS v3.1 score of 8.1.
- Flaws include authentication bypass, incorrect authorization, SSRF, and CSRF.
- Energy, IT, and water sectors are cited; no exploitation is reported.
- CVEs
- CVE-2026-107333CVE-2026-107334CVE-2026-107335CVE-2026-107336CVE-2026-107337CVE-2026-107361CVE-2026-107362
- Vendors
- CISA
- Organizations
- CISA
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-107333 | RBAC path-normalization bypass in Malcolm nginx proxy | 8.1 | — | ||
CVE-2026-107362+2 related CVEs | Authenticated SSRF in Malcolm file-upload via FilePond PHP | 7.1 group max | — | ||
CVE-2026-107337+1 related CVE | CSRF on unauthenticated Malcolm kiosk management endpoint | 7.1 group max | — | ||
| CVE-2026-107336 | Auth bypass and identity spoofing in CISA Malcolm Arkime proxy | 6.5 | — |
From the original article
7 min read at cisa.govView CSAF Summary The following versions of CISA Malcolm are affected: Malcolm <=v26. 07. 1 (CVE-2026-107336, CVE-2026-107333, CVE-2026-107362, CVE-2026-107361, CVE-2026-107337, CVE-2026-107335, CVE-2026-107334) Malcolm <=v26.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.