CISA Advises Critical Vulnerabilities in Malcolm ICS Platform

The Cybersecurity and Infrastructure Security Agency (CISA) published advisory ICSA-26-254-01, identifying six security vulnerabilities in the CISA Malcolm industrial control systems platform. The disclosed flaws span multiple attack vectors and severity levels.

CVE-2026-90443 is a cross-site scripting (XSS) vulnerability where the web interface reflects request URL input into script contexts and hyperlink attributes without adequate encoding. The flaw does not require authentication and could allow an unauthenticated attacker to execute arbitrary script in the context of the affected application or redirect a user's browser to an external site.

CVE-2026-90444 tracks an OS command injection flaw in the file-transfer interface. The interface accepts attacker-controlled filenames without restricting shell metacharacters; a subsequent process constructs and runs a system command using the uploaded file's name. This could allow an authenticated attacker to execute arbitrary operating system commands with process privileges, potentially reading or modifying ingested log data and enabling further internal network movement.

CVE-2026-90445 is a path traversal vulnerability in the file upload functionality. The interface extracts contents of uploaded archives without validating that extracted file paths remain within the intended destination directory. An authenticated attacker could craft an archive whose entries traverse outside the destination directory, allowing write access to arbitrary locations with process privileges. This could facilitate injection of fabricated records or tampering with application configuration.

CVE-2026-90446 details a server-side request forgery (SSRF) flaw, with further specifics on authentication bypass and request redirection provided in the advisory.

The remaining two vulnerabilities listed in the advisory include authentication bypass by spoofing, missing authorization, missing authentication for critical functions, incorrect authorization, use of default credentials, improper certificate validation, URL redirection to untrusted sites (open redirect), dependency on a vulnerable third-party component, and use of password hashes with insufficient computational effort.

CISA notes that the affected product, CISA Malcolm, is deployed worldwide across critical infrastructure sectors including Energy, Information Technology, and Water and Wastewater. The vendor headquarters is located in the United States.

Mitigation guidance directs affected users to update their instance of Malcolm to the latest version (September 2026 or later). No workarounds are specified in the advisory.