CISA published ICS Advisory ICSA‑26‑280‑01 on October 15 2026 detailing several vulnerabilities affecting the CISA Malcolm software.

The advisory covers six vulnerability types: Authentication Bypass by Spoofing, Incorrect Authorization, Server‑Side Request Forgery (SSRF), Authentication Bypass Using an Alternate Path or Channel, Cross‑Site Request Forgery (CSRF), and Improper Handling of Highly Compressed Data (Data Amplification). CISA Malcolm is deployed in the Energy, Information Technology, and Water and Wastewater Systems critical infrastructure sectors.

Affected versions include Malcolm ≤v26.07.1 for CVE‑2026‑107336, CVE‑2026‑107361, CVE‑2026‑107337, CVE‑2026‑107335, and CVE‑2026‑107334; as well as Malcolm ≤v26.08.0 for CVE‑2026‑107333 and CVE‑2026‑107362.

CVE‑2026‑107336 is caused by a case‑insensitive regex matcher combined with a case‑sensitive rewrite in the nginx reverse proxy, allowing requests with non‑lowercase path segments to bypass the rewrite and reach the Arkime backend unauthenticated. This vulnerability was patched in Malcolm version v26.08.0.

CVE‑2026‑107333 involves a URL‑path normalization inconsistency between the Lua‑based RBAC authorization layer and nginx routing logic, allowing authenticated users to bypass role‑based restrictions on restricted paths such as file upload, PHP server, htadmin, and authentication management interfaces.

For CVE‑2026‑107362, the Malcolm file‑upload component ships the upstream FilePond PHP server largely unmodified; its index.php exposes a fetch API route that instructs the server to download an arbitrary URL with curl, including FOLLOWLOCATION.

CVE‑2026‑107361 (corrected from a typographical error) concerns the Arkime live capture service in Malcolm running with network_mode: host, exposing port 8005 on all network interfaces. Arkime trusts the X-Forwarded-User header from any IP address and auto‑creates users with full access.

The Eclipse Foundation recommends upgrading to the latest patched versions of Malcolm to mitigate these issues.

References

  • https://www.cisa.gov/news-events/ics-advisories/icsa-26-280-01