CISA Malcolm
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition or execute arbitrary code. The following versions of CISA Malcolm are affected: Malcolm <26.06.1 (CVE-2026-55676) Malcolm <26.07.0 (CVE-2026-63133, CVE-2026-63134, CVE-2026-63177) Malcolm <=26.07.1 (CVE-2026-19670, CVE-2026-19671) CVSS Vendor Equipment Vulnerabilities v3 8.8 CISA CISA Malcolm Allocation of Resources Without Limits or Throttling, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Unrestricted Upload of File with Dangerous Type, Incorrect Authorization, Improper Handling of Highly Compressed Data (Data Amplification) Background Critical Infrastructure Sectors: Information Technology Countries/Areas Deployed: Worldwide Company Headquarters Location: United States Vulnerabilities Expand All + CVE-2026-63133 Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, safe-extract.py extracts uploaded archives with no limit on entry count, directory depth, total entries, or output size. A small malicious archive containing a large number of directory or file entries causes the filebeat processing container to create an unbounded number of filesystem objects, exhausting inodes or filesystem metadata and denying service to the processing pipeline and any service sharing the same mount. Version 26.07.0 fixes the issue. View CVE Details Affected Products CISA Malcolm Vendor: CISA Product Version: CISA Malcolm: <26.07.0 Product Status: known_affected Remediations Vendor fix Malcolm version 26.07.0 addresses these issues. For more information, see https://github.com/cisagov/Malcolm/pull/1043. (CVE-2026-63133, CVE-2026-63134, CVE-2026-63177) https://github.com/cisagov/Malcolm/pull/1043 Relevant CWE: CWE-770 Allocation of Resources Without Limits or Throttling Metrics CVSS Version Base Score Base Severity Vector String 3.1 6.5 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H 4.0 7.1 HIGH
CSIRTS triage
- What
- Multiple vulnerabilities in CISA Malcolm including resource exhaustion, path traversal, improper upload handling, authorization bypass, and data amplification issues.
- Who is affected
- Deployments of CISA Malcolm versions before 26.06.1, 26.07.0, and up to 26.07.1 worldwide.
- Urgency
- Critical; CVSS 8.8 with potential for both denial of service and arbitrary code execution.
- Action
- Upgrade to CISA Malcolm version 26.06.1, 26.07.0, or 26.07.2 depending on your current version.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Malcolm
Get an email when a new Malcolm advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://www.cisa.gov/news-events/ics-advisories/icsa-26-230-01
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-556760.30% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 22% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-631330.25% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 17% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-631340.25% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 16% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-631770.18% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 8% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-196700.17% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 7% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-196710.31% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 23% of all EPSS-scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-55676 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-63133 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-63134 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-63177 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-19670 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-19671 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- mediumCVE-2026-19671: Malcolm's upload-processing pipeline (scripts/safe-extract.py) enforces entry-count, nesting-d…nvd
- mediumCVE-2026-19670: Malcolm's nginx Lua role-based access control (RBAC) layer decides whether an authenticated us…nvd
- highCVE-2026-63177: Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, role-based access …nvd
- mediumCVE-2026-63134: Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, `safe-extract.py` …nvd
- mediumCVE-2026-63133: Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, `safe-extract.py` …nvd
- highCVE-2026-55676: Malcolm is a network traffic analysis tool suite. The file-upload component (FilePond PHP back…nvd
More from CISA Cybersecurity Advisories
- highCISA Adds One Known Exploited Vulnerability to Catalog2026-08-19
- criticalDefending Against an Active Threat to Siemens S7 Series PLCs2026-08-19
- highCISA Adds Four Known Exploited Vulnerabilities to Catalog2026-08-18
- criticalSiemens Simcenter Nastran2026-08-18
- highCISA Adds One Known Exploited Vulnerability to Catalog2026-08-17