CISA has warned that its Malcolm network-security platform contains multiple vulnerabilities, including a high-severity command-injection flaw that could let an authenticated attacker execute operating-system commands with the privileges of an automated process. The agency lists Malcolm as a known-affected product and says the latest version released in September 2026 or later fixes the vulnerabilities. CISA’s advisory urges affected users to update their instances.
The most severe issue described in the advisory is CVE-2026-90444, which carries a CVSS v3.1 score of 8.8. Malcolm’s file-transfer interface requires valid credentials but accepts attacker-controlled filenames without blocking shell metacharacters. An automated process later incorporates the filename into a system command, allowing an authenticated attacker to run arbitrary commands with that process’s privileges.
CISA says successful exploitation of that flaw could let an attacker read or modify ingested log data and establish a foothold for movement within an internal network. The vulnerability requires authentication, but the advisory rates it high severity because it can affect confidentiality, integrity and availability.
The advisory also describes an unauthenticated cross-site scripting flaw, CVE-2026-90443, with a CVSS v3.1 score of 5.4. A portion of a request URL is reflected into a script context and a hyperlink attribute without adequate encoding. An attacker can craft a link that executes arbitrary script when a user visits it, redirect the browser to an external site and act with the compromised user’s session privileges within Malcolm.
Other listed weaknesses affect file extraction, backend requests, authentication routing and authorization controls. CVE-2026-90445 allows an authenticated attacker to upload an archive containing paths that escape the intended destination directory, potentially writing files to arbitrary locations with the application’s privileges. CISA says that could enable fabricated records to be injected into stored data or application configuration to be altered.
CVE-2026-90446 involves a user-supplied value inserted into the path of a backend request to Malcolm’s search and analytics data store. CISA says an authenticated attacker could use the flaw to make the application’s elevated service credentials access unintended internal endpoints, exposing configuration or administrative data. Another issue, CVE-2026-90447, lets a low-privileged authenticated user who knows a shared service credential manipulate a client-controlled header to bypass a primary role check and reach an elevated role.
The advisory further identifies a missing-authorization flaw in a deployment mode intended to provide read-only access. CISA says an authenticated user could use an insufficiently restricted API route to create or overwrite stored records. It also describes a configuration in which a reverse proxy sends requests to a bundled administrative interface without first applying the gateway’s authentication requirement, leaving access control to that interface’s own login mechanism.
Malcolm is identified in the advisory as being deployed worldwide, with relevance to the energy, information technology, and water and wastewater sectors. CISA’s remediation is to install the latest Malcolm release, identified as September 2026 or later. The advisory does not report known public exploitation of the listed vulnerabilities and was initially published on October 1, 2026.