CISA flags seven flaws in its own Malcolm network-monitoring tool, top score 8.1

CISA has published advisory ICSA-26-280-01 covering seven CVEs in Malcolm, its own network traffic analysis platform, deployed worldwide across energy, IT and water sectors. The defects range from unauthenticated access to the Arkime backend to a CSRF route that can permanently delete captured traffic. This segment walks through what each flaw allows, which versions are affected, and where the fixes landed.

• Advisory ICSA-26-280-01 covers seven CVEs in CISA Malcolm, affecting versions up to and including v26.08.0.
• CVE-2026-107333, an RBAC path-normalization bypass, carries the highest score at CVSS v3 8.1 HIGH and was patched in v26.09.0.
• CVE-2026-107362, a server-side request forgery in the FilePond upload component, was also patched in v26.09.0.
• CVE-2026-107337 lets an attacker use CSRF against the kiosk Flask endpoint to run control.py --wipe, permanently deleting captured traffic; it was fixed in v26.08.0.
• CISA states no known public exploitation specifically targeting these vulnerabilities has been reported to date.

Executive summary

CISA released advisory ICSA-26-280-01 on 7 October 2026 and updated it on 15 October 2026, disclosing seven CVEs in CISA Malcolm, the agency's own network traffic analysis platform. The advisory records the product as deployed worldwide, with the company headquarters…

Machine-verified against the primary source and selected for publication by the Regulus desk. Not individually read by an editor. Lead briefings and anything our checks flag always are — how we review.