The Cybersecurity and Infrastructure Security Agency has warned that multiple vulnerabilities affect CISA Malcolm, which is listed in the agency’s advisory as deployed worldwide. CISA identifies energy, information technology, and water and wastewater as critical infrastructure sectors associated with the advisory. The affected product status is listed as “known_affected.”

CISA says the latest version of Malcolm, identified in the advisory as September 2026 or later, fixes the vulnerabilities. Affected users are encouraged to update their Malcolm instances to the latest version, according to CISA’s advisory.

The most serious issue described in the advisory is an operating-system command injection flaw, tracked as CVE-2026-90444 and rated 8.8, or high severity, under CVSS 3.1. A file-transfer interface that requires valid credentials accepts filenames containing shell metacharacters. An automated process later uses the uploaded filename to construct and run a system command.

CISA says an authenticated attacker could use the flaw to execute arbitrary operating-system commands with the privileges of that process. Successful exploitation could allow an attacker to read and modify ingested log data and could provide a foothold for further movement within an internal network.

The advisory also identifies a path-traversal vulnerability, CVE-2026-90445, in archive handling. An interface accepts file uploads from authenticated users and extracts the contents of uploaded archives without validating that extracted paths remain within the intended destination directory. An attacker could craft an archive whose entries move outside that directory, causing the extraction process to write files to arbitrary locations with the privileges of the process.

CISA says the path-traversal flaw could allow an attacker to inject fabricated records into Malcolm’s stored data or tamper with application configuration. The issue has a CVSS 3.1 base score of 6.5, or medium severity.

Another vulnerability, CVE-2026-90443, affects a web interface that reflects part of a request URL into a script context and a hyperlink attribute without adequate encoding. The interface does not require authentication to reach. CISA says an unauthenticated network attacker could craft a link that, when visited by a user, executes arbitrary script in the context of the affected application and redirects the user’s browser to an external site. The attacker could then act with the compromised user’s session privileges within the application. CISA rates the flaw 5.4, or medium severity, under CVSS 3.1.

The advisory describes CVE-2026-90446 as a server-side request forgery vulnerability involving an application programming interface endpoint. The endpoint inserts a user-supplied value into the path of a backend request to the underlying search and analytics data store without restricting its contents. An authenticated attacker could substitute an arbitrary backend path, causing the application’s elevated service credentials to be used against unintended internal endpoints. CISA says this could allow the attacker to enumerate or read internal configuration and administrative data from the backend data store.

CISA also describes an authentication-routing flaw, CVE-2026-90447. A routing rule selects between two authentication mechanisms for the same downstream service based on a client-supplied request header. An authenticated user with a shared service credential could manipulate that header to bypass the primary role-based authorization check and reach an alternate path with a fixed, elevated role. A low-privileged authenticated attacker who knows the shared credential could then perform actions reserved for a higher-privileged role.

CVE-2026-90448 affects a deployment mode intended to provide read-only access to stored data. CISA says one application programming interface route can create or overwrite a stored record, including with an attacker-chosen identifier, using the application’s elevated backend credentials. An authenticated user could therefore forge or overwrite records that should not be modifiable in that deployment mode.

The advisory further identifies missing authentication for a critical function, incorrect authorization, default credentials, improper certificate validation, open redirection, vulnerable third-party components and insufficient password-hashing effort among the listed Malcolm weaknesses. CISA’s advisory provides the same vendor-fix direction for the listed vulnerabilities: affected users are encouraged to update their Malcolm instances to the latest version.