Vendors › CISA

CISA security advisories

3 CISA ICS advisories for CISA in the last tracking window, 0 flagged as relevant to oil & gas. Newest first.

High 8.1 ICSA-26-280-01 · Oct 7, 2026 · CISA

CISA Malcolm

CISA reports 7 vulnerabilities in CISA Malcolm. Weakness types: Authentication Bypass by Spoofing, Incorrect Authorization, Server-Side Request Forgery (SSRF) (+3 more). Successful exploitation of these vulnerabilities could allow an unauthenticated attacker to gain access to the Arkime backend API under a forged ident…

What to do: Prioritize: This vulnerability was patched in Malcolm Version v26.08.0
High 8.8 ICSA-26-254-01 · Sep 11, 2026 · CISA

CISA Malcolm

CISA reports 15 vulnerabilities in CISA Malcolm. Weakness types: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'…

What to do: Prioritize: The latest version of Malcolm (September 2026 or later) fixes these vulnerabilities. Affected users are encouraged to update their instance of Malcolm to the latest version.
High 8.8 ICSA-26-230-01 · Aug 18, 2026 · CISA

CISA Malcolm

CISA reports 6 vulnerabilities in CISA Malcolm. Weakness types: Allocation of Resources Without Limits or Throttling, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Unrestricted Upload of File with Dangerous Type (+2 more). Successful exploitation of these vulnerabilities could allow an…

What to do: Prioritize: Malcolm version 26.07.0 addresses these issues. For more information, see https://github.com/cisagov/Malcolm/pull/1043. (CVE-2026-63133, CVE-2026-63134, CVE-2026-63177)