When the Watchdog Has Holes: Seven Vulnerabilities in CISA's Own ICS Monitoring Platform
Executive Summary
In October 2026, CISA published ICS Advisory ICSA-26-280-01 disclosing seven vulnerabilities in CISA Malcolm, the agency's own open-source network traffic analysis and ICS security monitoring platform. Reported by Seth Grover of Idaho National Laboratory, the flaws span authentication bypass via nginx regex spoofing (CVE-2026-107336), hardcoded credentials enabling direct Arkime backend access (CVE-2026-107361), SSRF through an unmodified FilePond PHP component (CVE-2026-107362), RBAC bypass via URL path normalization inconsistency (CVE-2026-107333), cross-site request forgery enabling forensic log destruction (CVE-2026-107337), percent-encoding authorization bypass (CVE-2026-107334), and a gzip-bomb denial-of-service (CVE-2026-107335). Collectively these vulnerabilities expose critical-infrastructure operators—in Energy, IT, and Water sectors worldwide—to unauthenticated access, privilege escalation, lateral movement, and destruction of forensic evidence.
The compromise of a security-monitoring tool itself represents an acute supply-chain and defense-evasion risk. As ICS/OT environments deepen their dependence on network-visibility platforms, adversaries now actively target the monitoring layer—blinding defenders while moving laterally through operational technology networks, a tactic increasingly observed in critical-infrastructure threat campaigns.
Why This Matters Now
Seven vulnerabilities in CISA's own ICS monitoring platform—some unauthenticated and remotely exploitable—arrive as nation-state actors intensify attacks on critical-infrastructure security tooling. With patches only released through v26.09.0, unpatched Malcolm deployments across Energy, Water, and IT sectors remain exposed to forensic blind spots and full administrative takeover at a moment when OT network visibility is the last line of defense.
Attack Path Analysis
An attacker targeting CISA Malcolm exploits an nginx regex/rewrite mismatch (CVE-2026-107336) or direct port exposure (CVE-2026-107361) to gain unauthenticated access to the Arkime backend with a forged identity header, immediately bypassing all authentication controls. Using percent-encoding bypass techniques (CVE-2026-107334, CVE-2026-107333), the attacker escalates from a low-privilege authenticated session to administrative endpoints, then pivots laterally through the SSRF vector (CVE-2026-107362) to reach internal services, establishes persistence via administrative interface manipulation, exfiltrates captured network forensic data, and finally weaponizes CSRF (CVE-2026-107337) or deploys a gzip bomb (CVE-2026-107335) to destroy forensic evidence and blind the ICS security monitoring platform.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
The attacker sends a crafted HTTP request with a mixed-case path (e.g., /IDDASH2ARK/...) to Malcolm's nginx reverse proxy, exploiting the case-insensitive regex match but case-sensitive rewrite mismatch (CVE-2026-107336). The authentication middleware is bypassed, and the request reaches the Arkime backend unauthenticated. The attacker simultaneously injects a forged X-Forwarded-User header, which Arkime trusts unconditionally, auto-provisioning a full-access identity. Alternatively, a network-adjacent attacker bypasses nginx entirely by connecting directly to Arkime port 8005 using the hardcoded passwordSecret 'Malcolm' and a forged identity header (CVE-2026-107361).
Related CVEs
CVE-2026-107336
CVSS 6.5CISA Malcolm nginx reverse proxy uses a case-insensitive regex matcher with a case-sensitive rewrite for the Dashboards-to-Arkime shortcut location, allowing unauthenticated network callers to reach the Arkime backend and forge user identity via a manipulated X-Forwarded-User header.
Affected Products:
CISA Malcolm – <= v26.07.1
Exploit Status:
no public exploitCVE-2026-107333
CVSS 8.1CISA Malcolm nginx reverse proxy contains a URL path normalization inconsistency between its Lua-based RBAC authorization layer and nginx routing logic, allowing an authenticated user to bypass role-based restrictions and access administrative endpoints.
Affected Products:
CISA Malcolm – <= v26.07.1, <= v26.08.0
Exploit Status:
no public exploitCVE-2026-107362
CVSS 7.1CISA Malcolm ships an unmodified FilePond PHP server exposing a fetch API route that allows an authenticated user to instruct the server to download arbitrary URLs via curl, enabling Server-Side Request Forgery (SSRF) and full readback of fetched content.
Affected Products:
CISA Malcolm – <= v26.07.1, <= v26.08.0
Exploit Status:
no public exploitCVE-2026-107361
CVSS 4.2CISA Malcolm Arkime live capture service binds port 8005 on all interfaces and trusts X-Forwarded-User from any IP with a hardcoded passwordSecret of 'Malcolm', allowing a network-adjacent attacker to bypass nginx authentication entirely and forge user identity.
Affected Products:
CISA Malcolm – <= v26.07.1
Exploit Status:
no public exploitCVE-2026-107337
CVSS 7.1CISA Malcolm kiosk Flask application exposes an unauthenticated POST /script_call/ endpoint with wildcard CORS, enabling CSRF attacks that allow an attacker to execute management commands including wiping all captured network traffic and forensic logs.
Affected Products:
CISA Malcolm – <= v26.07.1
Exploit Status:
no public exploitCVE-2026-107335
CVSS 6.5CISA Malcolm upload-processing pipeline fails to apply archive extraction limits to single-stream compressed formats (.gz, .bz2, .xz, .lzma, .lz), allowing an authenticated user to upload a gzip bomb that exhausts shared Docker volume storage and disrupts the platform.
Affected Products:
CISA Malcolm – <= v26.07.1
Exploit Status:
no public exploitCVE-2026-107334
CVSS 5.4CISA Malcolm nginx Lua RBAC layer evaluates percent-encoded URIs without decoding them, while nginx routes requests using decoded, normalized URIs, allowing an authenticated low-privilege user to access admin-only paths via percent-encoded path segments.
Affected Products:
CISA Malcolm – <= v26.07.1
Exploit Status:
no public exploit
MITRE ATT&CK® Techniques
Exploit Public-Facing Application
Modify Authentication Process
Abuse Elevation Control Mechanism
Network Boundary Bridging
Exploitation for Client Execution
Network Denial of Service
Data Destruction
Application Layer Protocol
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
CISA Zero Trust Maturity Model (ZTMM) 2.0 – Identity Verification and Least-Privilege Access Enforcement
Control ID: Identity Pillar - Authentication & Authorization
NIST SP 800-53 Rev 5 – Identification and Authentication, Access Enforcement, Transmission Confidentiality, and Information Input Validation
Control ID: IA-2, AC-3, SC-8, SI-10
NIS2 Directive (EU) 2022/0383 – Technical and Organizational Security Measures for Essential and Important Entities
Control ID: Article 21 - Cybersecurity Risk Management Measures
DORA (Digital Operational Resilience Act) Regulation (EU) 2022/2554 – ICT Risk Management and Operational Resilience
Control ID: Article 9 - ICT Security Policies and Article 10 - ICT-Related Incident Management
PCI DSS 4.0 – Vulnerability Management, Access Control Systems, and User Authentication
Control ID: Requirement 6.3, 7.2, 8.2
ICS/OT Security - IEC 62443-3-3 – Human User Identification, Authentication, Authorization, and Network Segmentation
Control ID: SR 1.1, SR 1.2, SR 2.1, SR 7.6
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Oil/Energy/Solar/Greentech
CISA Malcolm vulnerabilities expose ICS network monitoring in energy critical infrastructure to authentication bypass and SSRF exploits, enabling adversaries to blind forensic logging and exfiltrate operational traffic data.
Information Technology/IT
Malcolm's RBAC bypass, CSRF, and gzip bomb CVEs directly compromise IT security operations tooling, undermining zero trust segmentation and multicloud visibility controls mapped to NIST 800-53 and ZTMM frameworks.
Utilities
Utilities deploying Malcolm for ICS packet capture face unauthenticated Arkime access via forged X-Forwarded-User headers, risking destruction of network forensic evidence through CSRF-triggered control.py wipe commands.
Computer/Network Security
Security tool compromise via Malcolm's seven CVEs undermines intrusion detection integrity, with SSRF and authorization flaws defeating egress policy enforcement and anomaly detection capabilities across monitored environments.
Sources
- CISA Malcolmhttps://www.cisa.gov/news-events/ics-advisories/icsa-26-280-01Verified
- CISA Malcolm GitHub Repository - Idaho National Laboratory / cisagovhttps://github.com/cisagov/MalcolmVerified
- CISA ICS Advisories Landing Pagehttps://www.cisa.gov/news-events/ics-advisoriesVerified
- CISA Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
- Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies - CISAhttps://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdfVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is directly relevant here because the attacker's ability to reach Arkime's backend port directly, forge identity headers, and pivot across internal container services depends entirely on unrestricted network reachability between workloads. By enforcing workload-level segmentation and identity-aware access boundaries, CNSF would likely reduce the attacker's blast radius across the Malcolm container network and the broader ICS monitoring infrastructure it serves.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Direct network reachability to Arkime's backend port from untrusted or adjacent network segments would likely be constrained, reducing the attacker's ability to bypass the nginx proxy layer entirely and limiting opportunistic access paths that rely on open east-west connectivity.
Control: Zero Trust Segmentation
Mitigation: The attacker's ability to reach administrative interfaces beyond their assigned role scope would likely be constrained, since Zero Trust segmentation could reduce the network reachability of privileged management endpoints to only explicitly authorized workload identities rather than any authenticated session.
Control: East-West Traffic Security
Mitigation: The Malcolm container's ability to initiate outbound connections to arbitrary internal network destinations would likely be constrained, reducing the attacker's capacity to use the SSRF vector as a lateral reconnaissance tool across adjacent ICS container workloads and internal service endpoints.
Control: Multicloud Visibility & Control
Mitigation: The attacker's ability to blend covert command traffic within Malcolm's legitimate monitoring flows and establish persistent outbound command channels would likely be reduced, since multicloud visibility enforcement could surface anomalous outbound connection patterns that deviate from expected monitoring infrastructure behavior.
Control: Egress Security & Policy Enforcement
Mitigation: The attacker's ability to move large volumes of sensitive forensic data and internally fetched credentials outbound through Malcolm's network boundary would likely be constrained, since egress policy enforcement could limit which external destinations and protocols are permitted for workloads handling sensitive ICS capture data.
If prior CNSF controls had constrained lateral movement and limited the attacker's access to administrative interfaces and shared volumes, the scope of destructive actions against forensic data would likely have been reduced, since the attacker's ability to reach the wipe command surface and exhaust shared storage depends on the unrestricted internal access established in earlier stages.
Impact at a Glance
Affected Business Functions
- ICS/OT Network Traffic Analysis and Forensic Logging
- Security Monitoring and Incident Detection for Critical Infrastructure
- Captured PCAP and Network Forensics Data Integrity
- Administrative Access Control and Identity Management
Estimated downtime: 3 days
Estimated loss: N/A
Exploitation of these vulnerabilities could result in unauthorized access to captured network traffic and forensic logs from Energy, IT, and Water/Wastewater sector environments; complete destruction of all stored PCAP and forensic log data via the CSRF wipe command; unauthorized read access to sensitive network captures and internal service data via SSRF; and privilege escalation granting full administrative control over the Malcolm platform including OpenSearch, Logstash, Arkime, and Zeek components. No confirmed data exfiltration has been reported; however, the attack surface encompasses critical ICS/OT monitoring data deployed worldwide.
Recommended Actions
Key Takeaways & Next Steps
- • Deploy Zero Trust Segmentation to isolate Malcolm components: Apply identity-based microsegmentation policies so Arkime, FilePond, OpenSearch, and the kiosk Flask application operate in separate network namespaces with workload-to-workload policy enforcement, preventing lateral movement via SSRF from reaching internal metadata services or adjacent ICS infrastructure.
- • Enforce East-West Traffic Security to contain SSRF and inter-container pivoting: Implement east-west traffic controls with service-to-service policy that explicitly whitelists permitted internal flows; server-initiated curl requests to arbitrary internal destinations (CVE-2026-107362) would be blocked before internal reconnaissance or data staging can succeed.
- • Apply Multicloud Visibility and Control to detect authentication anomalies and forged header abuse: Enable centralized traffic observability and anomaly detection across Malcolm's reverse proxy layer to identify repeated requests with mixed-case path manipulation, forged X-Forwarded-User headers, and percent-encoded URI patterns indicative of CVE-2026-107336 and CVE-2026-107334 exploitation attempts.
- • Use Egress Security and Policy Enforcement to prevent forensic data exfiltration: Enforce outbound FQDN filtering and egress policy controls so that Arkime PCAP exports, OpenSearch data, and FilePond transfer directory contents cannot be transmitted to unauthorized external destinations, directly countering data exfiltration of ICS network capture data.
- • Leverage Cloud Native Security Fabric (CNSF) inline enforcement to block exploit traffic at the network layer: Position inline IPS with Suricata signatures for known exploit patterns (path traversal, percent-encoding bypass, SSRF fetch patterns) at the Malcolm deployment perimeter and between container workloads, ensuring that exploitation attempts matching CVE signatures are detected and blocked before authentication bypass or privilege escalation can be achieved.
