CISA released ICSA-26-230-01 on August 18, disclosing six vulnerabilities in Malcolm, the free network traffic analysis suite built by CISA in partnership with Idaho National Laboratory. That makes this an unusual advisory: the vulnerable product is the defensive tool many OT security teams already run to watch their own control networks. Malcolm ingests full packet captures, Zeek logs, and Suricata alerts, and it ships with parsers for the protocol set that matters to ICS/OT engineers — Modbus, DNP3, BACnet, EtherNet/IP-CIP, S7comm/COTP, PROFINET, IEC 60870-5-104, OPC UA Binary, HART-IP, Omron FINS, GE SRTP, and Synchrophasor (IEEE C37.118), among others. Any site using Malcolm for passive visibility into a Purdue Level 0-3 network segment should treat this as an operational patch, not a routine IT update.
The vulnerabilities
The most severe finding, CVE-2026-55676 (CVSS v3.1 8.8, CVSS v4.0 8.7, CWE-434), affects Malcolm versions before 26.06.1. The file-upload component’s allow-list for accepted extensions defaults to an empty array, meaning it accepts everything — including .php. An authenticated user holding only an upload-only role can drop a web shell and execute arbitrary PHP as the www-data user, effectively converting a monitoring-only account into code execution on the analysis host. Given that Malcolm instances are frequently fed live PCAP or Zeek data from SPAN/TAP points inside OT network segments, a compromised Malcolm host is a foothold with direct visibility into — and potentially reachability toward — the monitored control network.
Three additional issues (fixed in 26.07.0) stem from the archive-extraction path used when analysts upload PCAP bundles. CVE-2026-63133 (CVSS v3.1 6.5, CWE-770) lets a malicious archive extract with no cap on entry count, directory depth, or output size, exhausting inodes and denying service. CVE-2026-63134 (CVSS v3.1 5.4, CWE-22) is a path-traversal flaw in directory creation during extraction, allowing ../ sequences or absolute paths to write outside the intended extraction directory. CVE-2026-63177 (CVSS v3.1 7.1, CWE-863) is more concerning operationally: Malcolm’s role-based access control evaluates unnormalized request URIs while its Nginx front end routes on normalized paths, so a low-privilege user can slip a traversal segment like /x/../upload/... past RBAC checks to reach restricted upload functionality.
Two further access-control and resource-handling bugs, fixed in 26.08.0, round out the set. CVE-2026-19670 (CVSS v3.1 5.4, CWE-863) is a sibling RBAC bypass where pattern matching operates on percent-encoded URIs while Nginx resolves decoded paths — a request like /%68tadmin.php slides through. CVE-2026-19671 (CVSS v3.1 6.5, CVSS v4.0 7.1, CWE-409) allows single-stream compressed uploads (.gz, .bz2, .xz, .lzma, .lz) to bypass extraction size limits entirely, so an authenticated user can upload a compression bomb that decompresses to unbounded size and exhausts the shared Docker volumes backing the Malcolm deployment — a straightforward path to denying the monitoring capability itself. Researchers pavanchow, kah-ja, DeathRipper21, and tinyb0y are credited with the reports; CISA states no public exploitation has been observed to date.
Why it matters for OT operators
Malcolm is deployed specifically because it’s free, self-hosted, and doesn’t require sending OT traffic to a cloud vendor — a common requirement in air-gapped or regulated environments. That deployment pattern also means many instances run on infrastructure adjacent to, or fed directly from, sensitive network segments, and often with less rigorous patch cadence than production SCADA/HMI hosts because it’s viewed purely as a passive, read-only monitoring appliance. These CVEs invalidate that assumption: several require nothing more than an upload-capable account, a role commonly granted to junior analysts or automated log-forwarding integrations. A web shell on the Malcolm host doesn’t just risk the tool — it risks every packet capture and Zeek log of ICS protocol traffic the tool has ever ingested, plus any credentials or API tokens configured for forwarders pulling from historians, RTUs, or engineering workstations.
Recommended actions
Upgrade to Malcolm 26.08.0 or later, which resolves all six CVEs; the vendor fixes are tracked in GitHub PRs #1026 and #1043 and two GitHub Security Advisories (GHSA-jr6p-63pg-hr6g, GHSA-f2v6-8cj4-mhr6). Until upgraded, restrict upload-role accounts to the minimum set of trusted users, and audit Nginx/RBAC configuration for the URI-normalization mismatch described in CVE-2026-63177 and CVE-2026-19670. As with any Malcolm deployment, CISA’s standard ICS guidance still applies: keep the analysis host off the internet, place it behind the same network isolation controls protecting the OT segments it monitors, and require VPN access for remote administration rather than direct exposure. Given Malcolm’s role parsing S7comm, DNP3, and EtherNet/IP-CIP traffic for many utilities and manufacturers, verify patch status across every deployed instance — including ones stood up ad hoc for incident response or a specific segmentation project — since these tend to drift out of the normal patch management cycle applied to core SCADA infrastructure.