CVE-2026-90444 OS Command Injection in Malcolm
Authenticated attackers can execute arbitrary OS commands via malicious filenames in Malcolm's file-transfer interface, enabling data access and network movement.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-90444?
CVE-2026-90444 is a high-severity command injection vulnerability in CISA Malcolm, published on 11 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A file-transfer interface that requires valid credentials accepts attacker-controlled filenames without restricting shell metacharacters. An automated process later constructs and runs a system command using the uploaded file's name, allowing an authenticated attacker to embed and execute arbitrary operating system commands with the privileges of that process. This allows an attacker to read and modify ingested log data, and could provide a foothold for further movement within the internal network.
Weakness: CWE-78
Which versions are affected by CVE-2026-90444?
How do I fix CVE-2026-90444?
No fix has been published for CVE-2026-90444 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-90444 being exploited?
There is no known exploitation of CVE-2026-90444 in the wild and no public exploit code.
Sources
Also known as GHSA-3mw7-4727-j55f.