CVE-2026-19670

criticalCVSS 5.4covered by 2 sourcesfirst seen 2026-08-18

View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition or execute arbitrary code. The following versions of CISA Malcolm are affected: Malcolm <26.06.1 (CVE-2026-55676) Malcolm <26.07.0 (CVE-2026-63133, CVE-2026-63134, CVE-2026-63177) Malcolm <=26.07.1 (CVE-2026-19670, CVE-2026-19671) CVSS Vendor Equipment Vulnerabilities v3 8.8 CISA CISA Malcolm Allocation of Resources Without Limits or Throttling, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Unrestricted Upload of File with Dangerous Type, Incorrect Authorization, Improper Handling of Highly Compressed Data (Data Amplification) Background Critical Infrastructure Sectors: Information Technology Countries/Areas Deployed: Worldwide Company Headquarters Location: United States Vulnerabilities Expand All + CVE-2026-63133 Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, safe-extract.py extracts uploaded archives with no limit on entry count, directory depth, total entries, or output size. A small malicious archive containing a large number of directory or file entries causes the filebeat processing container to create an unbounded number of filesystem objects, exhausting inodes or filesystem metadata and denying service to the processing pipeline and any service sharing the same mount. Version 26.07.0 fixes the issue. View CVE Details Affected Products CISA Malcolm Vendor: CISA Product Version: CISA Malcolm: <26.07.0 Product Status: known_affected Remediations Vendor fix Malcolm version 26.07.0 addresses these issues. For more information, see https://github.com/cisagov/Malcolm/pull/1043. (CVE-2026-63133, CVE-2026-63134, CVE-2026-63177) https://github.com/cisagov/Malcolm/pull/1043 Relevant CWE: CWE-770 Allocation of Resources Without Limits or Throttling Metrics CVSS Version Base Score Base Severity Vector String 3.1 6.5 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H 4.0 7.1 HIGH

CSIRTS triage

What: Multiple vulnerabilities in CISA Malcolm including resource exhaustion, path traversal, improper upload handling, authorization bypass, and data amplification issues.
Who is affected: Deployments of CISA Malcolm versions before 26.06.1, 26.07.0, and up to 26.07.1 worldwide.
Urgency: Critical; CVSS 8.8 with potential for both denial of service and arbitrary code execution.
Action: Upgrade to CISA Malcolm version 26.06.1, 26.07.0, or 26.07.2 depending on your current version.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch CVE-2026-19670

Get an email if CVE-2026-19670 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.17% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 7% of all EPSS-scored CVEs.

Advisory coverage (2)

mediumCVE-2026-19670: Malcolm's nginx Lua role-based access control (RBAC) layer decides whether an authenticated us…nvd · 2026-08-18
criticalCISA Malcolmcisa · 2026-08-18

External references

NVD record for CVE-2026-19670

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-19670 status](https://www.csirts.com/badge/CVE-2026-19670)](https://www.csirts.com/cve/CVE-2026-19670)