CVE-2026-90456: fallo crítico en CISA Malcolm
Use of default credentials in Malcolm
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.2epss 0.3%
An example environment-configuration file for a bundled inventory-management component ships with a fixed, publicly-known administrative password. A deployment that copies this example file into active configuration without running the setup routine that regenerates credentials will expose that component's administrative interface to anyone aware of the default value.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
CISA · MalcolmCVEs relacionadas — CISA Malcolm
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-107333HIGHIncorrect Authorization in MalcolmEPSS 1.2%CVE-2026-107335MEDIUMImproper Handling of Highly Compressed Data in MalcolmEPSS 0.5%CVE-2026-107362HIGHServer-Side Request Forgery in MalcolmEPSS 0.4%CVE-2026-90445HIGHPath Traversal in MalcolmEPSS 0.3%CVE-2026-90444HIGHOS Command Injection in MalcolmEPSS 0.3%CVE-2026-90451HIGHUse of Default Credentials in MalcolmEPSS 0.3%