Our takeCISA Malcolm advisory ICSA-26-254-01 lists three CVEs with confirmed exploitation that can lead to XSS, OS command injection, or path traversal. Update to the latest version if you run Malcolm.Cyber Resilience desk
Sources (1)
- cisa_advisories · cisa_advisories
What this means for you — Security leader:CISA Malcolm advisory ICSA-26-254-01 lists three CVEs with confirmed exploitation (XSS, OS command injection, path traversal) that can lead to arbitrary code execution or DoS. Update to 26.07.2 or later if you run Malcolm.
What this means for you — Lean IT orgs:If you run CISA Malcolm for network monitoring, update it to version 26.07.2 or later right away — these flaws let attackers run commands or steal data.
What this means for you — MSP:Check every client running CISA Malcolm and update to 26.07.2 or later; the three CVEs are confirmed exploited in the wild.
What this means for you — Researcher:CISA Malcolm advisory ICSA-26-254-01 lists three CVEs with confirmed exploitation (XSS, OS command injection, path traversal) that can lead to arbitrary code execution or DoS. Update to 26.07.2 or later if you run Malcolm.