High Patch available CVSS up to 8.1
Six flaws found in CISA's Malcolm network analysis software
CISA ICS AdvisoriesCISA Malcolm · energy, water and wastewaterCVE-2026-107336, CVE-2026-107361, CVE-2026-107337
What happened. Six flaws affect Malcolm, including authentication bypass, incorrect authorisation, server-side request forgery (SSRF), cross-site request forgery (CSRF) and data amplification. Rated 8.1 on CVSS v3.
Who is affected. Malcolm up to v26.07.1 for some flaws and up to v26.08.0 for others. Sectors named: energy, information technology, water and wastewater.
What to do. Check whether you run Malcolm v26.08.0 or earlier.
Source: CISA ICS Advisories (opens cisa.gov)
More on Energy and power Water and wastewater CVE-2026-107336 CVE-2026-107337 CVE-2026-107361