CVE-2026-90450: fallo de gravedad media en CISA Malcolm
Incorrect Authorization in Malcolm
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.3epss 0.2%
The application's role-authorization lookup defaults to granting access when a request handler's name is not present in its table of role requirements, rather than defaulting to deny. Any request handler that is not explicitly registered in this table is reachable by any authenticated user regardless of their assigned role, and any newly added handler is fail-open by default until explicitly added to the table.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Productos afectados
CISA · MalcolmCVEs relacionadas — CISA Malcolm
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-107333HIGHIncorrect Authorization in MalcolmEPSS 1.2%CVE-2026-107335MEDIUMImproper Handling of Highly Compressed Data in MalcolmEPSS 0.5%CVE-2026-107362HIGHServer-Side Request Forgery in MalcolmEPSS 0.4%CVE-2026-90445HIGHPath Traversal in MalcolmEPSS 0.3%CVE-2026-90444HIGHOS Command Injection in MalcolmEPSS 0.3%CVE-2026-90456CRITICALUse of default credentials in MalcolmEPSS 0.3%