CISA 2026-10-01

CISA Malcolm

Machine-generated analysis · WAYSCloud LLM

Versions of CISA Malcolm earlier than 26.06.0 are listed as affected. The advisory reports that unauthenticated attackers can craft links that execute arbitrary script.

Context

The advisory concerns CISA Malcolm, a CISA-provided application. Versions prior to 26.06.0 are reported to contain multiple web-application flaws—including XSS, OS command injection, path traversal, SSRF, authentication bypass, missing authorization, default credentials, and others—that could let an unauthenticated network attacker execute arbitrary script and act with a compromised user’s session privileges. The product is noted as being deployed worldwide in the energy, information technology, and water and wastewater sectors. CISA states a fix is included in the September 2026 release (v26.06.0 or later).

Operator considerations

Patch: Update Malcolm to version 26.06.0 or later.
Log: Monitor for unexpected URL redirects or script execution attempts.

From Cybersecurity and Infrastructure Security Agency ↗

The following versions of CISA Malcolm are affected:

Malcolm

Vendor

Equipment

CISA

CISA Malcolm

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Server-Side Request Forgery (SSRF), Authentication Bypass by Spoofing, Missing Authorization, Missing Authentication for Critical Function, Incorrect Authorization, Use of Default Credentials, Improper Certificate Validation, URL Redirection to Untrusted Site ('Open Redirect'), Dependency on Vulnerable Third-Party Component, Use of Password Hash With Insufficient Computational Effort

Critical Infrastructure Sectors: Energy, Information Technology, Water and Wastewater

Countries/Areas Deployed: Worldwide

Company Headquarters Loca...

Read the full advisory on CISA →