CISA Malcolm
CISA details multiple Malcolm flaws before 26.06.0, including authenticated command injection CVE-2026-90444 scored CVSS 8.8.
CISA advisory ICSA-26-254-01 covers CISA Malcolm versions before 26.06.0 and lists multiple web and API flaws. The highest scored issue, CVE-2026-90444, is authenticated OS command injection through unsanitized upload filenames, with CVSS v3.1 8.8. Other described issues include unauthenticated reflected XSS and open redirect (CVE-2026-90443, CVSS 5.4), archive path traversal (CVE-2026-90445), SSRF against the backend data store (CVE-2026-90446), and authentication bypass by spoofing (CVE-2026-90447). CVE-2026-90448 is also assigned to a read-only deployment mode that proxies access to stored data.
- Malcolm versions before 26.06.0 are affected.
- CVE-2026-90444 is authenticated OS command injection, CVSS 3.1 8.8.
- CVE-2026-90443 is unauthenticated reflected XSS and open redirect, CVSS 5.4.
- Also includes path traversal, SSRF, and header-based authentication bypass.
- Deployed in energy, IT, and water and wastewater sectors.
- Vendors
- CISA
- Products
- Malcolm
- Organizations
- CISA
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-90443+1 related CVE | Reflected XSS in CISA Malcolm web interface | 5.3 | — | ||
| CVE-2026-90444 | Authenticated OS Command Injection in Log File-Transfer Interface (CVE-2026-90444) | 8.7 | — | ||
| CVE-2026-90445 | Zip Slip Path Traversal in Authenticated Archive Upload of Unspecified ICS Product | 7.1 | — | ||
| CVE-2026-90447 | Authentication Bypass via Client-Controlled Header in ICS-CERT-Assigned Product | 7.1 | — | ||
| CVE-2026-90448 | Missing Authorization in Read-Only Deployment Mode API Forges Records (CVE-2026-90448) | 7.1 | — |
From the original article
9 min read at cisa.govView CSAF Summary The following versions of CISA Malcolm are affected: Malcolm CVSS Vendor Equipment Vulnerabilities v3 8.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.