What is the CVSS score of CVE-2026-107337?

CVE-2026-107337 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H.

Which versions of Malcolm are affected by CVE-2026-107337?

CISA's Malcolm network traffic analysis platform contains a high-severity flaw (CVE-2026-107337, CVSS 7.1) that lets an attacker who convinces a Malcolm operator to open a malicious web page silently…

How to fix or mitigate CVE-2026-107337?

Within 24 hours, confirm which Malcolm deployments and kiosk hosts are running the affected platform, treat them as high-value targets, and immediately restrict operator browsing on those systems - prohibit general web and email access from the kiosk host, and require outbound traffic to be limited to the Malcolm management network. Place the kiosk behind an authenticating reverse proxy or network access control so that the POST /script_call/ endpoint cannot be reached from a browser session that has rendered third-party content, and block wildcard cross-origin behavior at the proxy layer if it can be configured. Enable host and network alerting for any request to /script_call/ paths (especially invocations resolving to control.py --wipe or control.py --stop), alert the SOC on any such event, and verify that captured PCAP and log data is being replicated to an isolated, write-protected backup so a wipe cannot destroy the sole copy of forensic evidence. Within 7 days, deploy the strongest available mitigation at the application layer by disabling or removing the /script_call/ management endpoint where operationally feasible, or gating it behind strong authentication and an allowlist of permitted script names, and by removing permissive CORS configuration (CORS(app)) so cross-origin browser requests are rejected. Confirm with the vendor whether an interim build, configuration hardening guidance, or hotfix exists and, if so, schedule deployment to all Malcolm instances; meanwhile, enforce that operators use a dedicated hardened workstation, not the kiosk itself, for any general browsing. Within 30 days, institutionalize the control set: require authenticated administrative access for all Malcolm management functions, add the endpoint and CORS configuration to configuration baselines and change management, test restore of captured traffic data from the isolated backup, and track CVE-2026-107337 against the vendor advisory for a vendor-released patch to be applied on an emergency change timeline. Note that no public exploit code and no confirmed active exploitation were identified at time of analysis, so these steps are precautionary hardening rather than incident response, but the destructive nature of the reachable commands justifies completing the 24-hour and 7-day items regardless.

Malcolm CVE-2026-107337

EUVD-2026-95120 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-10-08 icscert

GHSA-hfc4-x7vw-3m49

Python CSRF Flask Malcolm Cisa

7.1

CVSS 3.1 · Vendor: icscert

Severity by source

Vendor (icscert) PRIMARY

7.1 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

vuln.today AI

8.1 HIGH

CSRF is delivered over the network via a malicious page so AV:N (diverging from the input's AV:L); PR:N matches the zero-auth endpoint, UI:R for the required operator visit, C:N with I:H/A:H for destructive wipe/stop.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (icscert).

CVSS VectorVendor: icscert

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

POC Analysis Generated

Oct 08, 2026 - 19:22 vuln.today

Metadata Corrected

Oct 08, 2026 - 18:40 vuln.today

tag: Flask added

Analysis Generated

Oct 08, 2026 - 18:16 vuln.today

CVE Published

Oct 08, 2026 - 17:28 cve.org

HIGH 7.1

DescriptionCVE.org

The Malcolm kiosk Flask application exposes a POST /script_call/<script> endpoint with zero authentication and wildcard CORS (CORS(app)). An attacker can force the operator's browser to execute arbitrary management commands via CSRF, including control.py --wipe which permanently deletes all captured network traffic and forensic logs, or control.py --stop which blinds the security monitoring.

Articles & Coverage 1

News 4 New Python Vulnerabilities - 4 High Severity, 1 With POC Oct 09, 2026

AnalysisAI

Cross-site request forgery in the CISA Malcolm network traffic analysis platform lets a remote attacker who lures the operator into loading attacker-controlled web content force that operator's browser to fire unauthenticated management commands at the kiosk's POST /script_call/<script> endpoint. Successful abuse yields high integrity and availability impact (I:H/A:H) with no confidentiality impact (C:N), because the reachable commands are destructive rather than data-stealing - most notably control.py --wipe, which permanently deletes all captured network traffic and forensic logs, and control.py --stop, which blinds security monitoring. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Requires that a Malcolm operator's browser is used to reach the kiosk's /script_call/<script> endpoint while the operator is induced to load attacker-controlled web content (UI:R); the endpoint itself needs no credentials because it ships with zero authentication and wildcard CORS (CORS(app)), so no special server-side configuration change is needed - this is the default state. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a CWE-352 CSRF flaw with high integrity and availability impact (I:H/A:H) but no confidentiality impact (C:N), which fits a destructive-action vulnerability rather than a data-theft one. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Apply the patched Malcolm release specified in the vendor advisory at https://github.com/cisagov/Malcolm/security/advisories/GHSA-w8gq-4v5x-xrrm and cross-check the ICS-CERT ICSA-26-280-01 CSAF record for version confirmation; the provided data does not name an exact fixed version, so treat the advisory as the authoritative source for the upgrade target rather than assuming any specific build is clean. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, confirm which Malcolm deployments and kiosk hosts are running the affected platform, treat them as high-value targets, and immediately restrict operator browsing on those systems - prohibit general web and email access from the kiosk host, and require outbound traffic to be limited to the Malcolm management network. …

Threat intelligence, references, and detailed analysis are available after sign-in.