An authenticated remote command injection vulnerability in CISA Malcolm exposes the system to unauthorized command execution, potentially leading to full system compromise.

This vulnerability is an OS command injection (CWE-78) occurring in the file-transfer interface. An authenticated attacker can supply malicious filenames containing shell metacharacters, which are subsequently executed with the privileges of the system process.

The ability to execute arbitrary OS commands poses a severe risk to the integrity and availability of the Malcolm instance. With a CVSS score of 8.7, this high-severity flaw allows an authenticated attacker to manipulate ingested log data and establish a persistent foothold within the internal network, likely leading to unauthorized access to sensitive operational intelligence.

Immediate Action: Update the Malcolm instance to version 26.06.0 or later as recommended by the vendor.

Proactive Monitoring: Review system logs for suspicious file upload activity, particularly filenames containing non-standard characters or shell syntax, and monitor for unauthorized process execution.

Compensating Controls: Implement strict file naming policies or input validation at the Web Application Firewall (WAF) level to block requests containing suspicious shell metacharacters until the system can be patched.

Public Exploit Available: Unknown

Given the potential for complete system compromise and lateral movement, this vulnerability should be treated as a priority for remediation. Administrators must verify their current version and apply the update to version 26.06.0 immediately to mitigate the risk of command injection.