Vulnerabilities Identified in CISA Malcolm Network Analysis Tool

Source context: this article examines information published by the source on August 18, 2026. This site’s publication date is shown separately. Check the latest vendor guidance before acting.

What the vulnerability is

CISA has identified several vulnerabilities in Malcolm, a network traffic analysis tool suite used for visibility into industrial control systems (ICS) environments. These flaws range from authorization bypasses to resource exhaustion and unrestricted file uploads.

Specifically, the vulnerabilities include:
* Remote Code Execution: CVE-2026-55676 allows authenticated users with the ROLE_UPLOAD role to execute arbitrary PHP code as www-data due to an empty allow-list for uploaded file types.
* Authorization Bypasses: CVE-2026-63177 and CVE-2026-19670 allow authenticated low-privilege users to bypass Role-Based Access Control (RBAC) by using unnormalized request URIs or percent-encoding to access restricted admin paths.
* Denial of Service (DoS): CVE-2026-63133 and CVE-2026-19671 can lead to system instability. The former involves unbounded filesystem object creation during archive extraction, while the latter allows “gzip bombs” to exhaust shared Docker volumes.
* Path Traversal: CVE-2026-63134 allows the creation of directories outside the intended extraction directory during file extraction.

Exposure and applicability

These vulnerabilities affect different versions of CISA Malcolm. Asset owners should determine which version is currently deployed in their OT environment:

• Versions < 26.06.1: Vulnerable to CVE-2026-55676 (Remote Code Execution).
• Versions < 26.07.0: Vulnerable to CVE-2026-63133, CVE-2026-63134, and CVE-2026-63177.
• Versions <= 26.07.1: Vulnerable to CVE-2026-19670 and CVE-2026-19671.

Because Malcolm is often deployed to monitor sensitive industrial traffic, a compromise of the tool could potentially provide an attacker with visibility into OT network communications or a foothold within the management segment of the ICS network.

Remediation priorities

Our analysis suggests prioritizing updates based on the severity of the potential impact. We recommend the following sequence:

1. Immediate Update to Version 26.08.0 (or latest): This version addresses the most recent flaws, including the RBAC bypasses and gzip bomb DoS. Updating to this version also incorporates fixes from previous releases.
2. Address Remote Code Execution: If a full update is not immediately possible, ensuring the system is at least version 26.06.1 mitigates the arbitrary PHP execution risk (CVE-2026-55676).
3. Network Isolation: In alignment with CISA’s general recommended practices, ensure that Malcolm instances are not accessible from the internet and are isolated from business networks via firewalls.

How to validate remediation

To verify that exposure has been reduced, OT security leaders should perform the following:
* Version Verification: Confirm the installed version of Malcolm matches or exceeds 26.08.0. Note that a version check alone does not guarantee total security but confirms the application of known patches.
* Access Control Audit: Review the assigned roles for all users to ensure the principle of least privilege is applied, particularly regarding upload permissions.
* Network Path Validation: Verify through firewall logs or configuration audits that the Malcolm interface is only reachable from authorized management workstations and not from general business or external networks.

Limits and open questions

While updates address these specific CVEs, they do not eliminate all risks associated with network analysis tools. Residual risk remains if the underlying host OS or Docker environment is unpatched. Furthermore, CISA has reported no known public exploitation of these vulnerabilities at this time; however, the availability of these details may increase the likelihood of targeted attempts against vulnerable installations.

Source and editorial note

CISA Malcolm · Source date: August 18, 2026 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Request an OT security assessment