CISA Malcolm advisory: six vulnerabilities patched
CISA disclosed six vulnerabilities in the Malcolm network traffic analysis suite that could allow DoS or arbitrary code execution; patches are available.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 6 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CISA published an ICS advisory detailing six vulnerabilities affecting Malcolm, an open-source network traffic analysis tool suite maintained by CISA itself, deployed worldwide for IT/critical infrastructure monitoring. The flaws span multiple components: unsafe archive extraction (CVE-2026-63133, CVE-2026-63134) enabling denial-of-service via inode exhaustion and path traversal during file uploads; an unrestricted file upload flaw in the FilePond PHP backend (CVE-2026-55676) allowing an authenticated upload-only role to execute arbitrary PHP code as www-data; two RBAC bypass issues (CVE-2026-63177, CVE-2026-19670) caused by mismatches between how Nginx normalizes/decodes request URIs and how the Lua-based access control layer evaluates them, allowing low-privilege authenticated users to reach admin-restricted endpoints; and a decompression-bomb issue (CVE-2026-19671) where single-stream compressed uploads bypass size limits enforced on container archives, enabling resource exhaustion across the shared Docker volume used by OpenSearch, Logstash, Arkime, and Zeek.
All issues require authenticated access to exploit, and most stem from inconsistent input validation or normalization between Malcolm's Nginx/Lua RBAC layer and its backend processing scripts. The vendor (CISA) has released fixes across versions 26.06.1, 26.07.0, and 26.08.0 addressing the respective CVEs. No public exploitation has been reported. Given Malcolm's role in ICS/network security monitoring and multiple independent researchers reporting these issues, organizations running the tool should prioritize upgrading to the latest patched version and review RBAC role assignments, particularly the ROLE_UPLOAD permission.
Mentioned in this report
Detection guidance
Archive Extraction Writing Files Outside Upload Directory (Zip Slip Pattern)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects file system writes containing path traversal sequences during archive extraction, consistent with unsafe archive-extraction handling (e.g. Malcolm CVE-2026-63133/63134) where crafted filenames inside an uploaded archive escape the intended extraction directory. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Archive Extraction Writing Files Outside Upload Directory (Zip Slip Pattern)
description: Detects new files created with path traversal sequences (../) in their
target path, indicating an archive-extraction routine failed to sanitize member
filenames before writing to disk. This generalises the unsafe-extraction vulnerability
class (path traversal/inode exhaustion during upload processing) rather than a specific
exploit payload.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: file_event
product: linux
detection:
selection:
TargetFilename|contains: ../
filter_common_tmp:
TargetFilename|contains:
- /tmp/
- /var/tmp/
condition: selection and not filter_common_tmp
falsepositives:
- Legitimate backup/restore tools that use relative paths within temp directories
- Package managers extracting archives with unusual but benign relative references
level: medium
id: cf5a7a49-0fe9-5015-8022-f0c7f7d85eb1
status: experimental
author: Vorant
Encoded Path Traversal Targeting Admin Endpoint (Nginx/Lua RBAC Normalization Bypass)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects HTTP requests using percent-encoded or double-encoded traversal/normalization tricks aimed at admin-restricted URI paths, matching the RBAC-bypass pattern where Nginx URI decoding disagrees with the Lua access-control layer's evaluation of the same request. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Encoded Path Traversal Targeting Admin Endpoint (RBAC Normalization Bypass)
description: Detects requests where the URI contains encoded traversal or normalization
tricks (%2e%2e, %252e, double slashes, semicolon path params) combined with a path
segment referencing an admin or privileged endpoint. This matches the class of vulnerability
where a front-end reverse proxy normalizes a URI differently than the backend access-control
layer, allowing low-privilege users to reach restricted routes - not a specific
CVE payload.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: webserver
detection:
selection_encoding:
cs-uri-query|contains:
- '%2e%2e'
- '%252e'
- '%2f%2e%2e'
- ..;/
- //..
selection_admin_path:
cs-uri-stem|contains:
- /admin
- /api/admin
- /upload
condition: selection_encoding and selection_admin_path
falsepositives:
- Legitimate clients sending URL-encoded query parameters that happen to include dot-dot
sequences
- Automated vulnerability scanners performing authorized security testing
level: medium
id: a3c20e9f-27d6-503e-9664-71853ad0559f
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-230-01
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs