GajShield Threat Advisory — CISA Malcolm Authentication and Authorization Bypasses (ICSA-26-280-01)

Severity: High | Priority: 2

Malcolm is a network traffic analysis suite published by CISA and widely used to monitor industrial control system and OT networks. CISA advisory ICSA-26-280-01 covers several flaws in Malcolm v26.07.1 and earlier, all fixed in v26.08.0, with further hardening in v26.09.0:

• CVE-2026-107336: A mixed-case path such as /IDDASH2ARK/ skips authentication on the Arkime shortcut. Combined with a forged X-Forwarded-User header, it lets an attacker reach the Arkime packet-search interface as any user they name.
• CVE-2026-107361: The arkime-live service listens on TCP port 8005 on all interfaces and trusts the same forged header. An attacker on the same network can therefore bypass the web front end entirely.
• CVE-2026-107337: The kiosk’s /script_call/ endpoint requires no authentication. It can be made to wipe all captured traffic and forensic logs, or to stop monitoring.
• CVE-2026-107334: A logged-in user with low privileges can reach admin-only pages, such as user administration, by percent-encoding characters in the request path.

CISA reported no known public exploitation at publication. These attacks come from inside your network, so the source of any alert is an internal machine or user.

If an alert is raised for the Arkime shortcut or port 8005, treat it as unauthorized access to your captured network traffic. Identify the source machine and investigate it as possibly compromised. Then:

1. Review Arkime’s user list for accounts you don’t recognise, since forged identities are created automatically, and remove them.
2. Check Arkime’s history for searches, PCAP downloads and exports by those accounts, to see what traffic the attacker may have viewed.

If an alert is raised for the kiosk endpoint, identify the machine that sent the request. Legitimate kiosk use happens locally on the sensor, not over the network. Check that capture is still running and that stored traffic and logs are intact. If monitoring was stopped or data was wiped, restart capture and restore from backup if you can. Treat any gap as a period when attacker activity could have gone unseen.

If an alert is raised for an encoded admin path, identify the account that made the request. Review what it changed in Malcolm’s user administration, authentication settings, NetBox and uploads, then reset its password and review its permissions.

Whether or not you see alerts, upgrade Malcolm to v26.09.0. Run ./scripts/status before ./scripts/configure or ./scripts/start so your existing settings migrate correctly. Until you upgrade:

• Restrict inbound TCP 8005 to your Malcolm management nodes with ufw or iptables.
• Keep Malcolm off the internet, and isolate its sensor and analysis networks from user networks.
• Require VPN and multi-factor authentication for analyst access.
• Don’t browse untrusted websites from kiosk or sensor terminals.