Multiple Vulnerabilities in CISA Malcolm Network Analysis Suite

CISA Malcolm, a network traffic analysis suite, contains several critical vulnerabilities that may lead to arbitrary code execution, denial-of-service, or authorization bypass. An authenticated attacker can exploit insecure file upload handling to upload and execute malicious PHP scripts within the file-upload container. Additional flaws include path traversal vulnerabilities in the archival processing component and resource exhaustion (denial-of-service) via uncontrolled file extraction. Furthermore, authorization bypass vulnerabilities exist in the Nginx OpenResty Lua layer due to path normalization discrepancies, potentially allowing unauthorized access to restricted backend services. These issues affect various versions of CISA Malcolm prior to 26.07.0. Organizations should patch to the latest version to mitigate these security risks. The impacted CVEs are CVE-2026-55676, CVE-2026-63133, CVE-2026-63134, CVE-2026-63177, CVE-2026-19670, and CVE-2026-19671.

Impact

Successful exploitation of these vulnerabilities can lead to full compromise of the affected container via remote code execution (CVE-2026-55676) or persistent denial-of-service conditions (CVE-2026-63133). In environments where Malcolm is deployed for network monitoring, compromise may result in the exfiltration of sensitive captured traffic or unauthorized access to restricted control functions, impacting information technology infrastructure worldwide.

Recommendation

• Update CISA Malcolm installations to version 26.07.0 or later to address CVE-2026-63133, CVE-2026-63134, and CVE-2026-63177.
• Update CISA Malcolm to version 26.06.1 or later to address CVE-2026-55676.
• Restrict access to the Malcolm dashboard and upload interfaces to trusted users only to mitigate the risk from the authentication/authorization-dependent vulnerabilities.
• Review web server logs for suspicious POST requests to /server/php/submit.php that might indicate file upload exploitation attempts.