Critical Authentication & Authorization Flaws in CISA Malcolm (CVE‑2026‑107333 to CVE‑2026‑107362) Threaten Critical‑Infrastructure Monitoring
What It Is — Six high‑severity vulnerabilities (CVSS v3 8.1) have been disclosed in CISA Malcolm versions ≤ 26.07.1 and ≤ 26.08.0. The flaws include authentication bypass, SSRF, CSRF, and data‑amplification paths that can let an unauthenticated attacker reach backend services or trigger excessive processing.
Exploitability — All vulnerabilities are exploitable over the network with crafted HTTP requests; proof‑of‑concept code is publicly available in the advisory. No public exploit kits have been observed yet, but the attack surface is wide because the product is deployed worldwide in energy, IT, and water‑utility environments.
Affected Products — CISA Malcolm (on‑premises) versions ≤ 26.07.1 (five CVEs) and ≤ 26.08.0 (two CVEs).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous verification that authentication and authorization controls are correctly enforced across all service endpoints.
- Highlights gaps that can undermine audit evidence of “least‑privilege” enforcement, a core control many frameworks require.
- Shows why enterprise buyers now demand real‑time, verifiable proof that third‑party monitoring tools are not introducing privileged‑access shortcuts.
Recommended Actions
- Apply the vendor‑provided patches for all listed CVEs immediately.
- Review and harden reverse‑proxy and rewrite rules to ensure every backend path is protected by the authentication module.
- Enable comprehensive request logging and integrate logs into a SIEM for continuous monitoring of anomalous access attempts.
- Conduct an internal control assessment against the “access control” objective and capture evidence of remediation for audit readiness.
Source: CISA Advisory – ICSA‑26‑280‑01