Upgrade to Malcolm Version v26.08.0 which patches all seven CVEs. If immediate upgrade is not possible, restrict network access to the Malcolm management interface, monitor for unauthorized Arkime backend access, and review nginx reverse proxy configuration for case-sensitive rewrite rules.
Quick answers
What is CVE-2026-107337?
Upgrade to Malcolm Version v26.08.0 which patches all seven CVEs. If immediate upgrade is not possible, restrict network access to the Malcolm management interface, monitor for unauthorized Arkime backend access, and review nginx reverse proxy configuration for case-sensitive rewrite rules.
How severe is CVE-2026-107337?
critical, CVSS 8.1
Is CVE-2026-107337 known to be exploited?
It is not marked known-exploited in this record.
How should CVE-2026-107337 be mitigated?
Upgrade to Malcolm Version v26.08.0 which patches all seven CVEs. If immediate upgrade is not possible, restrict network access to the Malcolm management interface, monitor for unauthorized Arkime backend access, and review nginx reverse proxy configuration for case-sensitive rewrite rules.
CVSS
8.1
Vendor
CISA
Published
Oct 17, 2026 · 05:31
Patch
Unknown / not confirmed
Affected products
CISA Malcolm <=v26.07.1
Mitigation
Upgrade to Malcolm Version v26.08.0 which patches all seven CVEs. If immediate upgrade is not possible, restrict network access to the Malcolm management interface, monitor for unauthorized Arkime backend access, and review nginx reverse proxy configuration for case-sensitive rewrite rules.
The Cybersecurity and Infrastructure Security Agency (CISA) has released advisory ICSA-26-280-01 disclosing seven CVEs affecting CISA Malcolm industrial control system software versions up to 26.07.1. The vulnerabilities span authentication bypass by spoofing, incorrect authorization, server-side request forgery (SSRF), cross-site request forgery (CSRF), and incorrect authorization. Exploitation could allow unauthenticated network callers to reach the Arkime backend with forged identities, bypass role-based access controls, and fetch arbitrary URLs via the FilePond PHP component. Patching is available in Malcolm Version v26.08.0.