CVE-2026-90448: fallo de gravedad alta en CISA Malcolm
Missing Authorization in Malcolm
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.1epss 0.2%
A deployment mode intended to expose only read access to stored data proxies a set of application programming interface routes without restricting which request methods are allowed. One such route accepts a request that creates or overwrites a stored record, including an attacker-chosen identifier, using the application's own elevated backend credentials. This allows an authenticated user on a deployment intended to be read-only to forge or overwrite stored records that should not be modifiable in that deployment mode.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Productos afectados
CISA · MalcolmCVEs relacionadas — CISA Malcolm
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-107333HIGHIncorrect Authorization in MalcolmEPSS 1.2%CVE-2026-107335MEDIUMImproper Handling of Highly Compressed Data in MalcolmEPSS 0.5%CVE-2026-107362HIGHServer-Side Request Forgery in MalcolmEPSS 0.4%CVE-2026-90445HIGHPath Traversal in MalcolmEPSS 0.3%CVE-2026-90444HIGHOS Command Injection in MalcolmEPSS 0.3%CVE-2026-90456CRITICALUse of default credentials in MalcolmEPSS 0.3%