Vulnerability · Published Sep 11, 2026 · Assigned by icscert
CVE-2026-90456Use of default credentials in Malcolm
High 8.1
In plain English
A high-severity security flaw in Malcolm from CISA. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).
Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.3%top 80.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An example environment-configuration file for a bundled inventory-management component ships with a fixed, publicly-known administrative password. A deployment that copies this example file into active configuration without running the setup routine that regenerates credentials will expose that component's administrative interface to anyone aware of the default value.
Affected products (as reported)
Weakness: CWE-1392 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H