OTPulse

CISA Malcolm

Plan PatchCVSS 8.1ICS-CERT ICSA-26-280-01Oct 7, 2026
Attack path
Attack VectorNetwork
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

Malcolm versions v26.07.1 and earlier (and v26.08.0) contain multiple validation and authorization flaws (CWE-290, CWE-863, CWE-918, CWE-288, CWE-352, CWE-409) that allow authenticated users to intercept, manipulate, or forge network traffic data within the Malcolm analysis platform. An attacker with valid credentials could modify or hide network activity from being displayed to operators, leading to missed detection of actual threats.

What this means
What could happen
An attacker with valid credentials to Malcolm could intercept and manipulate network traffic analysis data, potentially causing operators to make incorrect decisions about network security or miss real threats.
Who's at risk
Network security teams and analysts using Malcolm for network traffic analysis and threat detection should prioritize this update. Malcolm is commonly deployed in utility SOCs and network operations centers to monitor critical infrastructure networks.
How it could be exploited
An attacker with engineering or analyst credentials logs into Malcolm and exploits improper validation of traffic analysis to intercept, forge, or redirect network data before it is processed and displayed to operators. This allows the attacker to hide malicious network activity or inject false alerts.
Prerequisites
  • Valid Malcolm user account (engineering or analyst role)
  • Network access to Malcolm interface
  • Knowledge of the specific traffic analysis workflow being targeted
requires authenticationlow complexity attackhigh impact on data integrityaffects security monitoring systems
Exploitability
Unlikely to be exploited — EPSS score 1.0%
Affected products (2)
2 with fix
ProductAffected VersionsFix Status
Malcolm <=v26.07.1≤ v26.07.1Fix available
Malcolm <=v26.08.0≤ v26.08.0Fix available
Remediation & Mitigation
0/3
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXUpdate Malcolm to version v26.09.0 or later
Long-term hardening
0/2
HARDENINGRestrict Malcolm access to trusted networks using network segmentation or firewall rules
HARDENINGReview user accounts and remove unnecessary privileged access to Malcolm
View full CISA ICS-CERT advisory
API: /api/v1/advisories/5df76c5d-9beb-4d9a-9f48-e4a6d676032a

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.