[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fKVzQv2iTP5KLvYlmoOWY559nOJtLWiG0n2lq92qN8zA":3},{"article":4,"iocs":47,"watch_terms":69,"solutions":70,"lesson":156},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":34},"d9fb1a66-1f23-40c3-9da5-1db9f585541a","CISA Malcolm","cisa-malcolm-307fc4","View CSAF Summary The following versions of CISA Malcolm are affected: Malcolm \u003C=v26.07.1 (CVE-2026-107336, CVE-2026-107361, CVE-2026-107337, CVE-2026-107335, CVE-2026-107334) Malcolm \u003C=v26.08.0 (CVE-2026-107333, CVE-2026-107362) CVSS Vendor Equipment v3 8.1 CISA Malcolm 6 Vulnerabilities Authentication Bypass by Spoofing, Incorrect Authorization, Server-Side Request Forgery (SSRF), Authentication Bypass Using an Alternate Path or Channel, Cross-Site Request Forgery (CSRF), Improper Handling of Highly Compressed Data (Data Amplification) Background Critical Infrastructure Sectors: Energy, Information Technology, Water and Wastewater Systems Countries\u002FAreas Deployed: Worldwide Company Headquarters Location: United States Vulnerabilities Expand All + CVE-2026-107336 Malcolm's front nginx reverse proxy defines a \"Dashboards → Arkime shortcut\" location using a case-insensitive regex matcher but a case-sensitive rewrite. A request whose path segment is not exact-lowercase (for example \u002FIDDASH2ARK\u002F...) enters the location (the matcher fires) but evades the rewrite (no redirect is issued), so nginx falls through to the location's proxy_pass to the Arkime backend. That location is the one proxied location in the shipped config that does not include the per-location authentication file, so the request reaches Arkime unauthenticated. The same location also forwards a client-supplied X-Forwarded-User header un-overwritten, and Arkime is configured to trust X-Forwarded-User as the authenticated username — so an unauthenticated network caller can reach the Arkime backend while supplying a forged, auto-provisioned identity. Read More 1 Affected Product CISA Malcolm \u003C=v26.07.1 Product Status: known_affected Remediations Vendor fix This vulnerability was patched in Malcolm Version v26.08.0 Additional Metrics Relevant CWE: CWE-290 Authentication Bypass by Spoofing CVSS Version Base Score Base Severity Vector String 3.1 6.5 MEDIUM CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:L\u002FA:N 4.0 CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:L\u002FVI:L\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N View CVE Details CVE-2026-107333 Malcolm's nginx based reverse proxy contains a URL path normalization inconsistency between its Lua based role-based access control (RBAC) authorization layer and nginx's own request routing logic. An authenticated user can craft a specially formatted request path to bypass role-based restrictions and reach administrative or role gated endpoints they should not have access to. This affects all restricted paths protected by the RBAC authorization layer, including file upload, PHP server, htadmin, and authentication management interfaces. Read More 2 Affected Products CISA Malcolm \u003C=v26.07.1 Product Status: known_affected Remediations CISA Malcolm \u003C=v26.08.0 Product Status: known_affected Remediations Vendor fix This vulnerability was patched in Malcolm Version v26.09.0 Additional Metrics Relevant CWE: CWE-863 Incorrect Authorization CVSS Version Base Score Base Severity Vector String 3.1 8.1 HIGH CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:N 4.0 CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N View CVE Details CVE-2026-107362 Malcolm file-upload component ships the upstream FilePond PHP server (pqina\u002Ffilepond-server-php) largely unmodified: Dockerfile copies all upstream *.php files and Malcolm only overwrites config.php and submit.php. Upstream index.php exposes a fetch API route that instructs the server to download an arbitrary URL with curl (including FOLLOWLOCATION) and, for HEAD requests, stores the fetched response body in the upload container's transfer directory and returns the transfer ID to the caller, enabling full readback of the fetched content. Read More 3 Affected Products CISA Malcolm \u003C=v26.07.1 Product Status: known_affected Remediations CISA Malcolm \u003C=v26.08.0 Product Status: known_affected Remediations Vendor fix This vulnerability was patched in Malcolm Version v26.09.0 CISA Malcolm \u003C=v26.08.0 Product Status: known_affected Remediations Vendor fix This vulnerability was patched in Malcolm Version v26.09.0 Additional Metrics Relevant CWE: CWE-918 Server-Side Request Forgery (SSRF) CVSS Version Base Score Base Severity Vector String 3.1 7.1 HIGH CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:L 4.0 CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:H\u002FVI:N\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N View CVE Details CVE-2026-107361 The Arkime live capture service (arkime-live) in Malcolm runs with network_mode: host, exposing port 8005 on all network interfaces (viewHost=0.0.0.0). Arkime trusts the X-Forwarded-User header from any IP address (userAuthIps=::,0.0.0.0\u002F0) and auto-creates users with full access. The passwordSecret is hardcoded to the public value \"Malcolm\". A network-adjacent attacker bypasses nginx entirely by connecting directly to port 8005 with a forged identity header. Read More 4 Affected Products CISA Malcolm \u003C=v26.07.1 Product Status: known_affected Remediations Vendor fix This vulnerability was patched in Malcolm Version v26.08.0 CISA Malcolm \u003C=v26.08.0 Product Status: known_affected Remediations CISA Malcolm \u003C=v26.08.0 Product Status: known_affected Remediations CISA Malcolm \u003C=v26.07.1 Product Status: known_affected Remediations Vendor fix This vulnerability was patched in Malcolm Version v26.08.0 Additional Metrics Relevant CWE: CWE-288 Authentication Bypass Using an Alternate Path or Channel CVSS Version Base Score Base Severity Vector String 3.1 4.2 MEDIUM CVSS:3.1\u002FAV:A\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:L\u002FA:N 4.0 CVSS:4.0\u002FAV:A\u002FAC:H\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:L\u002FVI:L\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N View CVE Details CVE-2026-107337 The Malcolm kiosk Flask application exposes a POST \u002Fscript_call\u002F endpoint with zero authentication and wildcard CORS (CORS(app)). An attacker can force the operator's browser to execute arbitrary management commands via CSRF, including control.py --wipe which permanently deletes all captured network traffic and forensic logs, or control.py --stop which blinds the security monitoring. Read More 5 Affected Products CISA Malcolm \u003C=v26.07.1 Product Status: known_affected Remediations Vendor fix This vulnerability was patched in Malcolm Version v26.08.0 CISA Malcolm \u003C=v26.08.0 Product Status: known_affected Remediations CISA Malcolm \u003C=v26.08.0 Product Status: known_affected Remediations CISA Malcolm \u003C=v26.07.1 Product Status: known_affected Remediations Vendor fix This vulnerability was patched in Malcolm Version v26.08.0 CISA Malcolm \u003C=v26.07.1 Product Status: known_affected Remediations Vendor fix This vulnerability was patched in Malcolm Version v26.08.0 Additional Metrics Relevant CWE: CWE-352 Cross-Site Request Forgery (CSRF) CVSS Version Base Score Base Severity Vector String 3.1 7.1 HIGH CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:N\u002FI:H\u002FA:H 4.0 CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:R\u002FVC:N\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N View CVE Details CVE-2026-107335 Malcolm's upload-processing pipeline (scripts\u002Fsafe-extract.py) enforces entry-count, nesting-depth, and total-uncompressed-byte limits when extracting container archives (zip\u002Ftar\u002Frar\u002F7z via libarchive), but those limits are not applied when the uploaded file is a single-stream compressed format (.gz, .bz2, .xz, .lzma, .lz) that isn't a .tar.*-style archive. Any authenticated user permitted to upload PCAP\u002Flog files can upload a small, highly compressible file (e.g. a gzip bomb) that decompresses to an effectively unbounded size on disk, exhausting the shared Docker volume used by OpenSearch, Logstash, Arkime, and Zeek, and disrupting the platform for all users. Read More 6 Affected Products CISA Malcolm \u003C=v26.07.1 Product Status: known_affected Remediations Vendor fix This vulnerability was patched in Malcolm Version v26.08.0 CISA Malcolm \u003C=v26.08.0 Product Status: known_affected Remediations CISA Malcolm \u003C=v26.08.0 Product Status: known_affected Remediations CISA Malcolm \u003C=v26.07.1 Product Status: known_affected Remediations Vendor fix This vulnerability was patched in Malcolm Version v26.08.0 CISA Malcolm \u003C=v26.07.1 Product Status: known_affected Remediations Vendor fix This vulnerability was patched in Malcolm Version v26.08.0 CISA Malcolm \u003C=v26.07.1 Product Status: known_affected Remediations Vendor fix This vulnerability was patched in Malcolm Version v26.08.0 Additional Metrics Relevant CWE: CWE-409 Improper Handling of Highly Compressed Data (Data Amplification) CVSS Version Base Score Base Severity Vector String 3.1 6.5 MEDIUM CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:H 4.0 CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N View CVE Details CVE-2026-107334 Malcolm's nginx Lua role-based access control (RBAC) layer decides whether an authenticated user may reach a role-restricted path (e.g. \u002Fhtadmin, \u002Fauth, \u002Fadmin_login, \u002Farkime\u002Fapi\u002Fesadmin, NetBox, upload endpoints) by pattern-matching the raw, percent-encoded request URI. Nginx itself, however, selects which location block actually serves the request using the percent-decoded, normalized URI. Because the RBAC check never percent-decodes its input, an authenticated low-privilege user can request an admin-only path using percent-encoding (e.g. \u002F%68tadmin.php) and have nginx route it to the restricted location while the Lua RBAC gate evaluating the un-decoded raw string finds no matching restriction and grants access. Read More 7 Affected Products CISA Malcolm \u003C=v26.07.1 Product Status: known_affected Remediations Vendor fix This vulnerability was patched in Malcolm Version v26.08.0 CISA Malcolm \u003C=v26.08.0 Product Status: known_affected Remediations CISA Malcolm \u003C=v26.08.0 Product Status: known_affected Remediations CISA Malcolm \u003C=v26.07.1 Product Status: known_affected Remediations Vendor fix This vulnerability was patched in Malcolm Version v26.08.0 CISA Malcolm \u003C=v26.07.1 Product Status: known_affected Remediations Vendor fix This vulnerability was patched in Malcolm Version v26.08.0 CISA Malcolm \u003C=v26.07.1 Product Status: known_affected Remediations Vendor fix This vulnerability was patched in Malcolm Version v26.08.0 CISA Malcolm \u003C=v26.07.1 Product Status: known_affected Remediations Vendor fix This vulnerability was patched in Malcolm Version v26.08.0 Additional Metrics Relevant CWE: CWE-863 Incorrect Authorization CVSS Version Base Score Base Severity Vector String 3.1 5.4 MEDIUM CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:L\u002FI:L\u002FA:N 4.0 CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:L\u002FVI:L\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N View CVE Details Acknowledgments Reporter Name(s): Seth Grover Idaho National Laboratory reported these vulnerabilities to CISA Legal Notice and Terms of Use This product is provided subject to this Notification (https:\u002F\u002Fwww.cisa.gov\u002Fnotification) and this Privacy & Use policy (https:\u002F\u002Fwww.cisa.gov\u002Fprivacy-policy). Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Minimize network exposure for all control system devices and\u002For systems, ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov\u002Fics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov\u002Fics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. CISA also recommends users take the following measures to protect themselves from social engineering attacks: Do not click web links or open attachments in unsolicited email messages. Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks. No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. Revision History Initial Release Date: 2026-10-07 Date Revision Summary 2026-10-07 1 Initial Publication 2026-10-15 2 Update A - Including self-reference to Web version Legal Notice and Terms of Use","CISA has released an advisory detailing six vulnerabilities affecting CISA Malcolm, a system used in critical infrastructure sectors like energy and water. The vulnerabilities include authentication bypass, server-side request forgery (SSRF), and cross-site request forgery (CSRF), with CVSS scores up to 8.1. These flaws could allow unauthenticated access, unauthorized data access, and denial of service. Patches are available for some versions, with recommendations to minimize network exposure.","CISA Malcolm suffers from six vulnerabilities, including authentication bypass and SSRF.","https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Fics-advisories\u002Ficsa-26-280-01",null,"2026-10-15T12:00:00+00:00","2026-10-15T18:00:17.912281+00:00",8,[17,19,22,24,26,28],{"name":6,"type":18},"product",{"name":20,"type":21},"nginx","technology",{"name":23,"type":21},"Arkime",{"name":25,"type":21},"PHP",{"name":27,"type":21},"curl",{"name":29,"type":21},"Flask","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":30,"icon":12,"name":32,"slug":33},"Vulnerabilities","vulnerabilities",[35,37,42],{"category":36},{"id":30,"icon":12,"name":32,"slug":33},{"category":38},{"id":39,"icon":12,"name":40,"slug":41},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",{"category":43},{"id":44,"icon":12,"name":45,"slug":46},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[48,52,55,58,61,64,66],{"type":49,"value":50,"context":51},"cve","CVE-2026-107336","Authentication Bypass by Spoofing in Malcolm",{"type":49,"value":53,"context":54},"CVE-2026-107361","Authentication Bypass Using an Alternate Path or Channel in Malcolm",{"type":49,"value":56,"context":57},"CVE-2026-107337","Cross-Site Request Forgery (CSRF) in Malcolm",{"type":49,"value":59,"context":60},"CVE-2026-107335","Improper Handling of Highly Compressed Data (Data Amplification) in Malcolm",{"type":49,"value":62,"context":63},"CVE-2026-107334","Incorrect Authorization in Malcolm",{"type":49,"value":65,"context":63},"CVE-2026-107333",{"type":49,"value":67,"context":68},"CVE-2026-107362","Server-Side Request Forgery (SSRF) in Malcolm",[6],{"controls":71,"vendors":155},[72,101,126],{"slug":73,"name":74,"problem":75,"products":76},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[77,85,93],{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"slug":102,"name":103,"problem":104,"products":105},"patch-management","Automated patch management","Known holes get closed in days, not months.",[106,111,119],{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":107,"product_name":108,"url":109,"description":110},"intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":102,"product_name":123,"url":124,"description":125},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":127,"name":128,"problem":129,"products":130},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[131,139,147],{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",{"vendor_slug":148,"vendor_name":149,"vendor_logo":150,"product_slug":151,"product_name":152,"url":153,"description":154},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",[],{"slug":157,"title":158,"body":159,"framework_refs":160,"framework_notes":171},"multiple-critical-vulnerabilities-found-in-cisa-malcolm-network-traffic-analyzer","Multiple Critical Vulnerabilities Found in CISA Malcolm Network Traffic Analyzer","CISA Malcolm, a widely used open-source network traffic analysis tool deployed across critical infrastructure sectors such as energy and water, was found to contain six significant vulnerabilities including authentication bypass, SSRF, and CSRF flaws. These weaknesses could allow unauthenticated attackers to gain unauthorized access, exfiltrate sensitive data, or cause denial of service — posing serious risks to operational technology (OT) environments. The presence of authentication bypass vulnerabilities is particularly dangerous in critical infrastructure contexts, where disruption can have real-world physical consequences. This incident highlights the importance of proactively tracking vulnerabilities in security tooling itself, not just the systems it monitors. Even trusted, purpose-built security tools must be subject to rigorous vulnerability management and network hardening practices.",[161,162,163,164,165,166,167,168,169,170],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 6: Access Control Management","NIST SP 800-82: Guide to ICS Security","NIST CSF ID.RA-1: Asset vulnerabilities are identified and documented","NIST CSF PR.AC-3: Remote access is managed","NIST CSF PR.PT-4: Communications and control networks are protected","IEC 62443-3-3: System security requirements for Industrial Automation and Control Systems","NERC CIP-007-6: Systems Security Management (for energy sector)","NIST SP 800-40: Guide to Enterprise Patch Management",{}]