These vulnerabilities allow attackers, depending on their authentication status, to execute arbitrary operating system commands with application privileges, traverse directory structures to write files to arbitrary locations, and interact with internal data stores. Malcolm is deployed globally across sectors including Energy, IT, and Water, making the timely application of vendor-provided patches essential for maintaining operational integrity.

Impact

Successful exploitation of these vulnerabilities can lead to full system compromise, unauthorized data exfiltration from internal backend services, and the injection of malicious records into diagnostic or logging data. Given the application's role in network traffic analysis and its deployment within critical infrastructure environments, successful exploitation could provide an attacker with a foothold for lateral movement into sensitive segments of an internal network.

Recommendation

Prioritize patching all instances of CISA Malcolm immediately.

• Upgrade all CISA Malcolm instances to the September 2026 release (v26.06.0 or later) as specified in the vendor remediation guidance.
• Implement strict ingress filtering for web and API interfaces to ensure only authorized personnel can interact with the system.
• Review all system logs for anomalous file upload activity or unexpected outbound connections from the Malcolm instance, which may indicate exploitation attempts related to CVE-2026-90444 or CVE-2026-90446.