Vulnerability · Published Sep 11, 2026 · Assigned by icscert

CVE-2026-90455Dependency on vulnerable third-party component in Malcolm

Low 3.7

In plain English

A low-severity security flaw in Malcolm from CISA. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)3.7Low

Exploit odds (30 days)0.2%top 90.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A prior update that raised a bundled HTTP client library to a version remediating known vulnerabilities was later reverted, reintroducing the earlier, vulnerable version into a log-processing component. The only code path in that component using the library issues a request to a single fixed, trusted vendor URL at initialization and does not process attacker-controlled input through the library, limiting practical exploitability of the reintroduced version in this context.

Affected products (as reported)

Vendor	Product	Versions
CISA	Malcolm	0 – before v26.06.0

Weakness: CWE-1395 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-254-01.json government-resource, vendor-advisory
https://www.cisa.gov/news-events/ics-advisories/icsa-26-254-01