CISA Malcolm

CISA issued an ICS advisory (ICSA-26-280-01) disclosing seven vulnerabilities in CISA Malcolm, a network traffic analysis tool used in critical infrastructure sectors including Energy, IT, and Water/Wastewater. Affected versions include Malcolm <=v26.07.1 and <=v26.08.0. The vulnerabilities include Authentication Bypass by Spoofing (CVE-2026-107336), Incorrect Authorization via URL path normalization (CVE-2026-107333, CVE-2026-107334), Server-Side Request Forgery via FilePond PHP server (CVE-2026-107362), Authentication Bypass through Arkime's direct port exposure (CVE-2026-107361), Cross-Site Request Forgery on the kiosk Flask app (CVE-2026-107337), and a Gzip bomb / data amplification vulnerability (CVE-2026-107335). The highest CVSS v3.1 score is 8.1 (HIGH) for CVE-2026-107333. Patches are available in Malcolm v26.08.0 and v26.09.0 depending on the CVE. The vulnerabilities were reported by Seth Grover of Idaho National Laboratory. No known public exploitation has been reported at this time.