CISA Malcolm Vulnerabilities (CVE-2026-19670/19671 & Others): Detection and Remediation Guide for Six Flaws in CISA's Network Traffic Analysis Platform

CISA has published ICS Advisory ICSA-26-230-01 covering six vulnerabilities in Malcolm, CISA's own open-source network traffic analysis platform. Successful exploitation could allow an attacker to cause a denial-of-service condition or execute arbitrary code on the sensor host. The highest-rated flaws carry a CVSS v3 score of 8.8 (High).

This one deserves immediate attention from every SOC and OT security team running Malcolm, and here's why: Malcolm isn't a typical endpoint application. It's a sensor platform — deployed at network choke points, often in OT/ICS environments, ingesting PCAP and live traffic via Zeek, Suricata, and Arkime. It sees everything on the wire. A compromised Malcolm instance is a compromised visibility layer: an attacker who owns your sensor can blind your detection pipeline, tamper with captured evidence, and pivot from a privileged network position into adjacent infrastructure. In the IR engagements I've led, the first thing sophisticated actors target after initial access is the logging and monitoring stack. This advisory hands them a roadmap if you leave it unpatched.

The affected versions and CVE mapping are as follows:

The advisory enumerates five CWE classes across the six CVEs: CWE-770 (Allocation of Resources Without Limits or Throttling), CWE-22 (Path Traversal), CWE-434 (Unrestricted Upload of File with Dangerous Type), CWE-863 (Incorrect Authorization), and CWE-409 (Improper Handling of Highly Compressed Data / Data Amplification). Malcolm deployments span the Information Technology sector and are widely used in ICS/OT monitoring — exactly the environments where sensor integrity is non-negotiable.

Technical Analysis

What Malcolm Is and Why It's a High-Value Target

Malcolm is a containerized (Docker Compose) network traffic analysis suite. Its architecture includes an nginx reverse proxy fronting multiple web interfaces: a PCAP/file upload interface, Arkime viewer, OpenSearch Dashboards, and an authentication layer (nginx local auth or Keycloak, depending on configuration). Analysts upload PCAP, PCAPNG, and Zeek log archives — frequently compressed (gz, zip, tar bundles) — which Malcolm then extracts and processes.

Every one of the weakness classes in this advisory maps directly onto that ingestion pipeline:

Unrestricted Upload of Dangerous File Type (CVE-2026-19670 — CWE-434)

The upload interface accepts files for processing. Insufficient validation of file type and extension means an authenticated (or, depending on auth misconfiguration, unauthenticated) attacker can upload a file with a dangerous type — the classic precondition for arbitrary code execution if the file lands somewhere executable or is subsequently processed by a vulnerable handler. On a Malcolm host, the upload service runs inside a container with access to the shared processing volumes; a webshell or malicious script uploaded through this path is a foothold on your sensor.

Path Traversal (CVE-2026-63133, CVE-2026-63134 — CWE-22)

Improper limitation of a pathname to a restricted directory in the file-handling components allows an attacker to supply crafted paths (e.g., ../../etc/... or absolute path sequences) to read or write files outside the intended upload/processing directory. Write-primitive traversal against a containerized service can overwrite configuration, drop cron/systemd payloads on bind-mounted host paths, or poison files consumed by other Malcolm services. Read-primitive traversal exposes credentials — Malcolm deployments store API keys, OpenSearch credentials, and nginx/Keycloak secrets in environment files on the host.

Incorrect Authorization (CVE-2026-19671 — CWE-863)

Function-level authorization checks are missing or incorrect on one or more management endpoints, allowing a lower-privileged user — or in some configurations an unauthenticated remote client — to invoke actions reserved for administrators. Combined with the upload flaw, this is the piece that can turn "authenticated user uploads a bad file" into "unauthenticated remote attacker achieves code execution."

Resource Exhaustion and Data Amplification (CVE-2026-55676, CVE-2026-63177 — CWE-770, CWE-409)

Malcolm's decompression pipeline handles highly compressed analyst uploads. Without limits on allocation and expansion ratios, a small zip-bomb-style archive expands into gigabytes, exhausting disk and memory on the sensor (data amplification, CWE-409). CWE-770 covers the absence of throttling on resource-consuming operations. Either flaw yields denial of service — and a DoS'd sensor is a blind SOC. In an OT environment, losing network visibility during an intrusion window is often worse than losing a workstation.

Exploitation Requirements and Status

Per the advisory, these are remotely exploitable flaws with low attack complexity; the CVSS 8.8 vector is consistent with network-adjacent exploitation requiring low privileges and no user interaction. As of publication there is no confirmed in-the-wild exploitation and no CISA KEV listing, and no public PoC has been observed. Treat that as a grace period, not a comfort: Malcolm's source is public, the advisory discloses the weakness classes, and patch-diffing a containerized open-source project to weaponize an upload/traversal flaw is days of work for a competent actor, not months.

Detection & Response

Detection against Malcolm centers on three observable behaviors: (1) suspicious uploads and dangerous file types hitting the upload/processing directories, (2) path-traversal sequences in web requests to the nginx front end, and (3) unexpected process execution or decompression-driven resource spikes inside the Malcolm host/containers. Malcolm hosts are Linux; forward syslog, nginx access logs, and auditd/process telemetry to your SIEM (Sentinel via Syslog/CEF ingestion works well here).

The following detections assume Malcolm's default layout (installation under a directory such as /opt/malcolm, nginx as the reverse proxy, Docker containers for upload/processing). Adjust paths to your deployment.

---
title: Path Traversal Attempt Against CISA Malcolm Web Interface
id: 3f8a1c42-7b2d-4e91-a6c5-9d0e2f4b8a17
status: experimental
description: Detects directory traversal sequences in HTTP requests proxied by Malcolm's nginx front end, consistent with exploitation of CVE-2026-63133 / CVE-2026-63134 path traversal flaws in Malcolm's file-handling components.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-230-01
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/08/18
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
  product: linux
  service: nginx
detection:
  selection_uri:
    cs-uri|contains:
      - '../'
      - '..%2f'
      - '%2e%2e/'
      - '%2e%2e%2f'
      - '..\\'
      - '%252e%252e'
  selection_target:
    cs-uri|contains:
      - '/upload'
      - '/api/'
      - '/file'
  condition: selection_uri and selection_target
falsepositives:
  - Rare; double-encoded sequences in upload/API paths are not legitimate analyst behavior
level: high
---
title: Dangerous File Type Written to Malcolm Upload or Processing Directory
id: 91c4d7e2-3a56-4f08-b2d1-6e7a0c5f9d34
status: experimental
description: Detects executable or script file types being created in Malcolm upload, extraction, or processing paths — the observable artifact of CWE-434 unrestricted upload exploitation (CVE-2026-19670).
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-230-01
  - https://attack.mitre.org/techniques/T1105/
  - https://attack.mitre.org/techniques/T1505.003/
author: Security Arsenal
date: 2026/08/18
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.t1105
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename|contains:
      - '/malcolm/'
      - '/upload'
      - '/extract'
      - '/pcap/process'
  selection_ext:
    TargetFilename|endswith:
      - '.php'
      - '.py'
      - '.sh'
      - '.pl'
      - '.jsp'
      - '.war'
      - '.so'
      - '.cgi'
  condition: selection_path and selection_ext
falsepositives:
  - Malcolm updates and manual analyst tooling; validate against change windows
level: high
---
title: Shell or Interpreter Spawned by Malcolm Container Services
id: 6e2b5f18-4c97-4d3a-9e86-1f3c7a0b5d29
status: experimental
description: Detects shells and script interpreters spawned under Docker container processes on a Malcolm sensor host, indicating post-exploitation activity following arbitrary code execution via upload or traversal flaws.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-230-01
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/08/18
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
      - '/docker'
      - '/containerd'
      - 'runc'
  selection_img:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
  condition: selection_parent and selection_img
falsepositives:
  - Interactive troubleshooting via docker exec; legitimate Malcolm maintenance scripts — baseline by user and TTY
level: high

For Microsoft Sentinel, assuming your Malcolm sensor ships syslog and nginx logs via the Syslog/CEF connector, this hunts traversal attempts and post-exploitation process execution together:

// Hunt for path traversal against Malcolm web tier and suspicious execution on the sensor host
let TraversalPatterns = dynamic(["../", "..%2f", "%2e%2e", "%2e%2e%2f", "%252e%252e", "..\\"]);
let Lookback = 7d;
union isfuzzy=true
    (CommonSecurityLog
    | where TimeGenerated > ago(Lookback)
    | where DeviceVendor =~ "nginx" or ApplicationProtocol =~ "http"
    | where RequestURL has_any (TraversalPatterns)
    | extend Indicator = "Path Traversal Attempt", Detail = RequestURL, SrcHost = SourceIP
    | project TimeGenerated, Indicator, SrcHost, Detail, DestinationHostName, DeviceAction),
    (Syslog
    | where TimeGenerated > ago(Lookback)
    | where SyslogMessage has_any (TraversalPatterns)
       and SyslogMessage has_any ("upload", "/api/", "malcolm")
    | extend Indicator = "Traversal in Syslog Stream", Detail = SyslogMessage, SrcHost = HostIP
    | project TimeGenerated, Indicator, SrcHost, Detail, Computer, ProcessName),
    (Syslog
    | where TimeGenerated > ago(Lookback)
    | where ProcessName has_any ("docker", "containerd", "runc")
       and SyslogMessage has_any ("/bin/sh", "/bin/bash", "python3", "curl ", "wget ", "nc ")
    | extend Indicator = "Shell/Interpreter Under Container Runtime", Detail = SyslogMessage, SrcHost = HostIP
    | project TimeGenerated, Indicator, SrcHost, Detail, Computer, ProcessName)
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Events = count() by Indicator, SrcHost, Detail
| order by LastSeen desc

For forensic triage of a Malcolm host you suspect was already touched — before you rebuild it — Velociraptor can enumerate dangerous files in the ingestion paths and live processes/network connections on the sensor:

-- Triage CISA Malcolm sensor for upload-abuse artifacts and post-exploitation processes
-- Targets dangerous file types in Malcolm data paths plus suspicious live processes/connections

LET files = SELECT FullPath, Size, Mtime AS Modified
FROM glob(globs=['/opt/malcolm/**/*.sh', '/opt/malcolm/**/*.py', '/opt/malcolm/**/*.php',
                 '/var/lib/docker/volumes/*upload*/**/*.sh', '/var/lib/docker/volumes/*upload*/**/*.py'],
          accessor='file')
WHERE Modified > parse(string='2026-08-01')

LET procs = SELECT Pid, Name, Exe, CommandLine, Username
FROM pslist()
WHERE Name =~ '(sh|bash|dash|python|perl|nc|ncat|curl|wget)$'
  AND CommandLine =~ '(malcolm|docker|/tmp/|/dev/shm|upload|extract)'

LET conns = SELECT Pid, Name, RemoteAddress, RemotePort, Status
FROM netstat()
WHERE Status =~ 'ESTABLISHED'
  AND RemotePort in (4444, 5555, 6666, 1337, 31337, 8443)

SELECT 'file' AS ArtifactType, FullPath AS Detail, '' AS Extra, Modified AS Timestamp FROM files
UNION ALL
SELECT 'process' AS ArtifactType, CommandLine AS Detail, Exe AS Extra, NULL AS Timestamp FROM procs
UNION ALL
SELECT 'network' AS ArtifactType, RemoteAddress + ':' + RemotePort AS Detail, Name AS Extra, NULL AS Timestamp FROM conns

The following Bash script verifies your Malcolm version against the advisory thresholds, checks the ingestion paths for already-staged dangerous files, and applies compensating controls while you schedule the upgrade:

#!/usr/bin/env bash
# Security Arsenal - CISA Malcolm ICSA-26-230-01 verify & harden script
# Run on the Malcolm sensor host as root. Test in staging first.
set -euo pipefail

MALCOLM_HOME="${MALCOLM_HOME:-/opt/malcolm}"
REPORT="/root/malcolm_icsa_26_230_01_$(date +%Y%m%d_%H%M%S).txt"

echo "=== ICSA-26-230-01 Malcolm Exposure Check ===" | tee "$REPORT"

# 1) Identify running Malcolm version from container image tags
echo -e "\n[1] Running Malcolm container versions:" | tee -a "$REPORT"
docker ps --format '{{.Names}}\t{{.Image}}' | grep -i malcolm | tee -a "$REPORT" || echo "No Malcolm containers found running" | tee -a "$REPORT"

CUR_VER=$(docker ps --format '{{.Image}}' | grep -oP 'malcolm[^:]*:\K[0-9]+\.[0-9]+\.[0-9]+' | sort -uV | tail -1 || true)
echo -e "\nDetected version: ${CUR_VER:-UNKNOWN}" | tee -a "$REPORT"

version_lt() { [ "$(printf '%s\n%s' "$1" "$2" | sort -V | head -1)" != "$2" ]; }

if [ -n "${CUR_VER:-}" ]; then
  VULN=0
  version_lt "$CUR_VER" "26.06.1" && { echo "EXPOSED: CVE-2026-55676 (< 26.06.1)" | tee -a "$REPORT"; VULN=1; }
  version_lt "$CUR_VER" "26.07.0" && { echo "EXPOSED: CVE-2026-63133 / CVE-2026-63134 / CVE-2026-63177 (< 26.07.0)" | tee -a "$REPORT"; VULN=1; }
  version_lt "$CUR_VER" "26.07.2" && { echo "EXPOSED: CVE-2026-19670 / CVE-2026-19671 (<= 26.07.1) - upgrade to >= 26.07.2" | tee -a "$REPORT"; VULN=1; }
  [ "$VULN" -eq 0 ] && echo "Version appears patched against ICSA-26-230-01" | tee -a "$REPORT"
fi

# 2) Sweep ingestion/upload paths for dangerous staged file types (CVE-2026-19670 artifact)
echo -e "\n[2] Dangerous file types under Malcolm data paths (review before deleting):" | tee -a "$REPORT"
find "$MALCOLM_HOME" /var/lib/docker/volumes -type f \
  \( -name '*.sh' -o -name '*.py' -o -name '*.php' -o -name '*.pl' -o -name '*.cgi' -o -name '*.so' \) \
  -newermt '2026-08-01' 2>/dev/null | tee -a "$REPORT" || true

# 3) Grep nginx logs for traversal attempts (CVE-2026-63133/63134 artifact)
echo -e "\n[3] Path traversal patterns in nginx access logs (last 30 days):" | tee -a "$REPORT"
for LOG in /var/log/nginx/access.log* "$MALCOLM_HOME"/nginx/logs/access.log*; do
  [ -e "$LOG" ] || continue
  zgrep -Eih '(\.\./|%2e%2e|%252e%252e|\.\.\\)' "$LOG" 2>/dev/null | tail -50 | tee -a "$REPORT"
done

# 4) Compensating controls pending upgrade
echo -e "\n[4] Applying compensating controls..." | tee -a "$REPORT"
# Restrict Malcolm web tier to trusted management networks only (adjust CIDR!)
MGMT_NET="10.0.0.0/8"
iptables -C INPUT -p tcp --dport 443 -s "$MGMT_NET" -j ACCEPT 2>/dev/null || \
  iptables -I INPUT -p tcp --dport 443 -s "$MGMT_NET" -j ACCEPT
iptables -C INPUT -p tcp --dport 443 -j DROP 2>/dev/null || \
  iptables -A INPUT -p tcp --dport 443 -j DROP
echo "Restricted tcp/443 (Malcolm web tier) to $MGMT_NET" | tee -a "$REPORT"

# Cap decompression bombs: enforce disk quota guard on the upload volume mount point
df -h "$MALCOLM_HOME" | tee -a "$REPORT"
echo -e "\nDONE. Review $REPORT, then plan upgrade to Malcolm >= 26.07.2" | tee -a "$REPORT"

Remediation

1. Upgrade immediately. Pull the latest Malcolm release from the official repository and rebuild your deployment. The fixed baselines per this advisory are:

• CVE-2026-55676 → fixed in 26.06.1
• CVE-2026-63133, CVE-2026-63134, CVE-2026-63177 → fixed in 26.07.0
• CVE-2026-19670, CVE-2026-19671 → fixed in the release after 26.07.1 — deploy 26.07.2 or later

Because Malcolm is Docker Compose-based, upgrading means pulling the updated release, updating image tags, and running the standard docker compose pull && docker compose up -d workflow per the project documentation. Do not cherry-patch individual containers — the flaws span multiple services.

2. Restrict exposure while patching. Malcolm's web tier (upload interface, Arkime, OpenSearch Dashboards) should never be reachable from untrusted networks. Enforce management-network-only access at the firewall/host level (see script above). For OT deployments, Malcolm should sit behind your industrial DMZ with no path from enterprise user VLANs, let alone the internet.

3. Enforce strong authentication. The incorrect-authorization flaw (CVE-2026-19671) is most dangerous when paired with weak or default auth. Confirm nginx local auth uses unique, rotated credentials, or better, run Keycloak with MFA for analyst access. Audit existing accounts for anything you didn't create.

4. Treat uploaded archives as hostile by policy. Even patched, the decompression pipeline processes arbitrary analyst-supplied archives. Apply disk quotas to the upload/extraction volumes, set container memory limits in your Compose overrides, and alert on expansion ratios — a 2 MB upload that becomes 20 GB is a CWE-409 event worth paging on.

5. Hunt before you patch. Run the detections above against at least 30 days of retained logs. Path traversal and upload exploitation leave artifacts in nginx access logs and the filesystem; if you find hits predating your upgrade, treat the sensor as compromised: preserve the PCAP store (it's also forensic evidence), rotate every credential stored on or used by the Malcolm host (OpenSearch, API keys, Keycloak), and rebuild from known-good media rather than upgrading in place.

6. Track the advisory. Source of record: ICSA-26-230-01 and the Malcolm GitHub repository. No KEV deadline exists as of this writing, but given the 8.8 CVSS, remote exploitability, and Malcolm's privileged network vantage, our recommendation to clients is patch within 7 days — 72 hours for any sensor with reachability beyond a dedicated management segment.

The uncomfortable irony of this advisory is that the tool defenders use to watch the wire became the thing to watch. That's not a reason to abandon Malcolm — it's a reminder that sensor infrastructure is production attack surface and belongs in your vulnerability management program with the same rigor as domain controllers and firewalls.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub