CISA ICSA-26-230-01: Malcolm Platform Vulnerability Advisory (6 CVEs)

Vulnerability Overview Vulnerability Name: CISA Malcolm Publication Date: August 18, 2026 Alert Code: ICSA-26-230-01 CVSS Score: v3 8.8 Vendor: CISA Product: CISA Malcolm Vulnerability Types: - Unrestricted or Unthrottled Resource Allocation - Improper Restriction of Path Name or Invalid Path Traversal - Upload of Dangerous Type of File - Improper Authorization - Improper Handling of Highly Compressed Data (Data Amplification) Affected Versions Affected Versions: - Malcolm <26.06.1 (CVE-2026-55676) - Malcolm <26.07.0 (CVE-2026-63133, CVE-2026-63134, CVE-2026-63177) - Malcolm <=26.07.1 (CVE-2026-19670, CVE-2026-19671) Remediation Recommended Practices: - Minimize network exposure; ensure all control system devices and/or systems are not accessible from the internet. - Place control system networks and remote devices behind firewalls and isolate them from the business network. - Use more secure remote access methods, such as Virtual Private Networks (VPN), and ensure the VPN is updated to the latest version. - Conduct appropriate impact analysis and risk assessment before deploying defensive measures. - Implement recommended cybersecurity policies to proactively defend ICS assets. - Follow internal procedures to report suspicious malicious activity. - Avoid clicking links or opening attachments in unsolicited emails. - Refer to the guidance provided by CISA on avoiding email fraud and social engineering attacks. Vulnerability Details CVE-2026-63133 CVE-2026-63134 CVE-2026-55676 CVE-2026-63177 CVE-2026-19670 CVE-2026-19671 Acknowledgments pavanchow reported CVE-2026-63133, CVE-2026-63134, and CVE-2026-63177. kah-ja, DeathRipper21 reported CVE-2026-55676. tinyboy reported CVE-2026-19670 and CVE-2026-19671. Revision History Initial Publication Date: 2026-08-18 Revision Version: 1 Summary: Initial Release Legal Notice and Terms of Use This product is subject to this notice and the privacy and usage policy. Tags Industry: Information Technology Industry Feedback Please share your thoughts; we have recently updated our anonymous product survey and welcome your feedback. Footer Information CISA Central: 1-844-Say-CISA, contact@cisa.dhs.gov Official Website: CISA.gov, Official website of the U.S. Department of Homeland Security The above is a summary of key information regarding the CISA Malcolm vulnerability from the webpage screenshot.

Goal Reached Thanks to every supporter — we hit 100%!

CISA ICSA-26-230-01: Malcolm Platform Vulnerability Advisory (6 CVEs)