CISA has warned that vulnerable versions of its Malcolm network traffic analysis platform contain multiple flaws, including an operating-system command injection issue rated 8.8 out of 10 under CVSS 3.1. The agency says the latest Malcolm release, dated September 2026 or later, fixes the vulnerabilities and urges affected users to update. CISA’s advisory lists energy, information technology, and water and wastewater among the critical infrastructure sectors using the platform worldwide.

The most severe issue described in the advisory is CVE-2026-90444. Malcolm’s file-transfer interface requires valid credentials but accepts filenames containing shell metacharacters. An automated process later uses the uploaded filename to construct and run a system command, allowing an authenticated attacker to execute arbitrary operating-system commands with the privileges of that process. CISA says successful exploitation could let an attacker read or modify ingested log data and establish a foothold for further movement inside an internal network.

A separate flaw, CVE-2026-90445, affects archive extraction. The upload process does not verify that files extracted from an archive remain inside the intended destination directory. An authenticated attacker could therefore create an archive with entries that traverse outside that directory and write files to arbitrary locations with the process’s privileges. CISA says the weakness could be used to inject fabricated records into stored data or alter application configuration.

The advisory also identifies an unauthenticated cross-site scripting flaw, CVE-2026-90443, in a web interface. Part of a request URL is reflected into a script context and a hyperlink attribute without adequate encoding. An attacker could craft a link that, when opened by a user, executes script in the application’s context and redirects the browser to an external site. CISA says an exploited session could allow actions using the privileges of the targeted user. The flaw carries CVSS 3.1 and 4.0 base scores of 5.4 and 5.3, respectively.

Several other vulnerabilities involve Malcolm’s backend request handling and authorization controls. CVE-2026-90446 allows an authenticated attacker to substitute an arbitrary path in a request to the underlying search and analytics data store. The application’s elevated service credentials could then be used against unintended internal endpoints, potentially exposing configuration or administrative data.

CVE-2026-90447 lets an authenticated user who possesses a shared service credential influence which authentication mechanism handles a request by changing a client-controlled header. CISA says a low-privileged user could use that behavior to bypass a primary role-based authorization check and reach an alternate path associated with a fixed, elevated role.

The advisory describes additional authorization weaknesses. In one case, a deployment intended to provide read-only access proxies application programming interface routes without limiting request methods. An authenticated user could use a route that creates or overwrites stored records, including records with an attacker-selected identifier. In another, the role-authorization lookup grants access when a request handler is absent from its table of role requirements, rather than denying access by default. That means unregistered handlers, including newly added ones, can be reachable by authenticated users regardless of their assigned role.

CISA also flags a missing-authentication weakness affecting a bundled third-party administrative interface. Under a particular authentication configuration, the reverse proxy forwards requests to that interface without first applying Malcolm’s gateway authentication. The interface manages the credential store used to protect other services, leaving access control dependent on the third party’s own login mechanism.

The advisory lists further issues involving default credentials, certificate validation, open redirects, vulnerable third-party components, password-hash computation, and server-side request forgery. The reported weaknesses span cross-site scripting, command injection, path traversal, missing authorization, improper authorization, authentication bypass, and missing authentication for a critical function. CISA identifies Malcolm as the affected product and marks it as known affected.

Users running affected Malcolm installations should move to the latest version identified by CISA as September 2026 or later. The agency’s advisory provides the vulnerability identifiers, severity metrics, and remediation notice for the platform.