Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-90454

Quick assessment

Affected
CISA Malcolm
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

一种部署模式旨在仅对捆绑的网络包分析组件的接口提供只读访问权限。该模式通过模式匹配的方式拒绝了一系列具有写权限的路由，但其匹配模式遗漏了那些会修改存储的会话记录上附加的标签的路由；此外，代理配置允许这些路由所使用的方法通过。因此，在原本应仅支持只读访问的部署中，已认证用户仍可对存储的会话记录添加或删除标签。

CVSS 5.3 · Medium EPSS 0.21% · P11

Affected Version Matrix 2

VendorProduct Version RangeStatus
CISA Malcolm < v26.06.0 affected
v26.06.0 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-90454

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
A deployment mode intended to expose only read access to a bundled packet-analysis component's interface denies a list of write-capable routes by pattern, but the pattern omits routes that modify tags attached to stored session records, and the proxy configuration otherwise permits the request method those routes use. This allows an authenticated user on a deployment intended to be read-only to add or remove tags on stored session records.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
CISA Malcolm 0 ~ v26.06.0 -

II. Public POCs for CVE-2026-90454

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-90454

请登录查看更多情报信息。

Same Patch Batch · CISA · 2026-09-11 · 15 CVEs total

CVE-2026-90456 9.2 CRITICAL 库存管理组件示例配置硬编码管理密码
CVE-2026-90444 8.7 HIGH 文件传输接口命令注入导致认证用户权限提升
CVE-2026-90451 8.2 HIGH 数据包分析组件硬编码密钥致认证Cookie可伪造
CVE-2026-90448 7.1 HIGH 只读模式未限制写操作，致记录可被覆盖
CVE-2026-90447 7.1 HIGH Apache Shiro 5.3.5 认证路由逻辑漏洞
CVE-2026-90445 7.1 HIGH 文件上传解压时路径遍历导致任意文件写入
CVE-2026-90457 6.9 MEDIUM 本地用户可读的管理密码弱哈希文件权限漏洞
CVE-2026-90449 6.9 MEDIUM 某网关特定认证模式下管理接口认证绕过
CVE-2026-90455 6.3 MEDIUM HTTP客户端库回滚致漏洞回归
CVE-2026-90452 6.0 MEDIUM Nginx反向代理至身份提供者证书验证缺失
CVE-2026-90446 5.3 MEDIUM Elasticsearch 任意路径插值导致凭据泄露
CVE-2026-90450 5.3 MEDIUM 应用角色授权查找默认放行：未注册处理器可被任意用户访问
CVE-2026-90443 5.3 MEDIUM 软件未认证反射型XSS漏洞
CVE-2026-90453 5.1 MEDIUM 文件上传Referer未校验致任意重定向

IV. Related Vulnerabilities

Same product: Malcolm
Same vendor: CISA
Same weakness: CWE-862

V. Comments for CVE-2026-90454

No comments yet

Leave a comment