CISA audited its own network tool and found a password hardcoded as 'Malcolm'

The lighter file this week is really a file about self-administration: the body that polices everyone's patching disclosed seven flaws in its own monitoring tool, including a password named after the product and an unauthenticated route to wiping forensic data. Alongside it, two US transparency portals returned access-control screens instead of notices, and HMRC amended the same export process twice in three months. The joke is free; the discipline it rewards is not.

• CISA advisory ICSA-26-280-01, updated 15 October 2026, lists seven CVEs in CISA's own Malcolm tool, including a passwordSecret hardcoded as "Malcolm".
• Malcolm fixes split across v26.08.0 and v26.09.0, so an operator who stops at v26.08.0 leaves CVE-2026-107333 and CVE-2026-107362 open.
• Federal Register pages for an SEC CME Securities Clearing notice dated 13 October and a Treasury information-sharing collection dated 9 October returned access-control screens with no operative text.
• HMRC amended its export examination-premises approval process on 8 October 2026, three months after an 8 July 2026 revision, and these notices carry the force of law.
• CISA reports no known public exploitation of the Malcolm flaws to date.

Executive summary

CISA's advisory ICSA-26-280-01, updated 15 October 2026, discloses seven CVEs in CISA Malcolm, the agency's own network traffic analysis tool, used worldwide in the energy, information technology, and water and wastewater sectors. The flaws include authentication bypass to the Arkime…

Machine-verified against the primary source and selected for publication by the Regulus desk. Not individually read by an editor. Lead briefings and anything our checks flag always are — how we review.