CISA has warned that known-affected versions of its Malcolm network-monitoring platform contain multiple vulnerabilities, including a high-severity flaw that could let an authenticated attacker execute operating-system commands. The agency said the latest Malcolm version, released in September 2026 or later, fixes the vulnerabilities and encouraged affected users to update. The advisory was published October 1, 2026, in CISA’s ICS advisory.
The most severe issue described in the advisory is CVE-2026-90444, which carries a CVSS v3.1 score of 8.8. Malcolm’s file-transfer interface requires valid credentials but accepts filenames containing shell metacharacters. An automated process later uses the uploaded filename to construct and run a system command, allowing an authenticated attacker to execute commands with the privileges of that process. CISA said exploitation could let an attacker read or modify ingested log data and potentially establish a foothold for movement within an internal network.
Several other flaws affect authenticated functions that handle uploaded files, backend requests and stored records. CVE-2026-90445 allows a crafted archive to place extracted files outside the intended destination directory. The resulting path-traversal flaw could let an attacker write files to arbitrary locations with the application process’s privileges, potentially injecting fabricated records or changing application configuration.
CVE-2026-90446 affects an application programming interface endpoint that passes a user-supplied value into the path of a request to Malcolm’s underlying search and analytics data store. CISA said an authenticated attacker could substitute an arbitrary backend path and cause the application’s elevated service credentials to access unintended internal endpoints. That could expose internal configuration or administrative data that would otherwise be restricted.
The advisory also identifies authorization weaknesses. In one deployment mode intended to provide read-only access, an API route can accept a request that creates or overwrites a stored record, including an attacker-selected identifier. Another flaw allows a client-controlled request header to determine which of two authentication mechanisms handles a request. A low-privilege authenticated user who knows a shared service credential could use that routing behavior to bypass the primary role-based authorization check and reach a fixed, elevated role.
Malcolm’s web interface contains a separate unauthenticated cross-site scripting flaw, CVE-2026-90443, rated medium with a CVSS v3.1 score of 5.4. The interface reflects part of a request URL into a script context and hyperlink attribute without adequate encoding. CISA said an attacker could craft a link that executes arbitrary script when a user visits it, redirects the browser to an external site and acts with the compromised user’s session privileges within the application.
The advisory further describes a missing-authentication issue involving a bundled third-party administrative interface. Under a particular authentication configuration, the reverse proxy forwards requests to that interface without first applying Malcolm’s gateway authentication requirement. CISA said access control for the interface, which manages the credential store used by the deployment’s other services, is then left to the third-party interface’s own login mechanism.
CISA lists Malcolm as deployed worldwide and identifies energy, information technology, and water and wastewater among the affected critical-infrastructure sectors. The advisory marks the product as known affected and lists a vendor fix rather than a temporary mitigation. Organizations running Malcolm should identify affected instances and move to the September 2026-or-later release identified by CISA, while accounting for the platform’s roles in ingesting logs, storing records and exposing administrative interfaces.