CISA Malcolm
view advisory published 2026-10-07
CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.
01
describes (7)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-107362US | — | — | ||
Malcolm file-upload component ships the upstream FilePond PHP server (pqina/filepond-server-php) largely unmodified: Dockerfile copies all upstream *.php files and Malcolm only ove… | ||||
| CVE-2026-107361US | —OT elevated | — | ||
The Arkime live capture service (arkime-live) in Malcolm runs with network_mode: host, exposing port 8005 on all network interfaces (viewHost=0.0.0.0). Arkime trusts the X-Forwarde… | ||||
| CVE-2026-107337US | — | — | ||
The Malcolm kiosk Flask application exposes a POST /script_call/<script> endpoint with zero authentication and wildcard CORS (CORS(app)). An attacker can force the operator's brows… | ||||
| CVE-2026-107336US | —OT elevated | — | ||
Malcolm's front nginx reverse proxy defines a "Dashboards → Arkime shortcut" location using a case-insensitive regex matcher but a case-sensitive rewrite. A request whose path segm… | ||||
| CVE-2026-107335US | —OT elevated | — | ||
Malcolm's upload-processing pipeline (scripts/safe-extract.py) enforces entry-count, nesting-depth, and total-uncompressed-byte limits when extracting container archives (zip/tar/r… | ||||
| CVE-2026-107334US | —OT elevated | — | ||
Malcolm's nginx Lua role-based access control (RBAC) layer decides whether an authenticated user may reach a role-restricted path (e.g. /htadmin, /auth, /admin_login, /arkime/api/e… | ||||
| CVE-2026-107333US | —OT elevated | — | ||
Malcolm's nginx based reverse proxy contains a URL path normalization inconsistency between its Lua based role-based access control (RBAC) authorization layer and nginx's own reque… | ||||
02
references
External citations — patches, advisories, analysis.
- ICSA Advisory ICSA-26-280-01 JSONself
- ICSA Advisory ICSA-26-280-01 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
03
remediations (7)
- FixedMalcolm
This vulnerability was patched in Malcolm Version v26.08.0
- FixedMalcolm
This vulnerability was patched in Malcolm Version v26.08.0
- FixedMalcolm
This vulnerability was patched in Malcolm Version v26.08.0
- FixedMalcolm
This vulnerability was patched in Malcolm Version v26.08.0
- FixedMalcolm
This vulnerability was patched in Malcolm Version v26.08.0
- FixedMalcolm
This vulnerability was patched in Malcolm Version v26.09.0
- FixedMalcolm
This vulnerability was patched in Malcolm Version v26.09.0
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan