Is CVE-2026-107336 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107336 being exploited in the wild.

How severe is CVE-2026-107336?

High severity, published 15 October 2026.

Which products and versions are affected?

CISA Malcolm <=26.07.1, <=26.08.0.

Is there a fix for CVE-2026-107336?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-107336 attacked?

It is attacked over the network.

Am I affected by CVE-2026-107336?

Check whether you run CISA Malcolm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107336: CISA Malcolm authentication and authorization flaws

Q: Which products and versions are affected?

CISA Malcolm <=26.07.1, <=26.08.0.

Q: Is there a fix for CVE-2026-107336?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-107336 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-107336?

Check whether you run CISA Malcolm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107336 · Severity: high · Published 2026-10-15

CISA Malcolm is a network traffic analysis and security monitoring tool used to detect threats in critical infrastructure networks. Multiple authentication, authorization, and request validation flaws allow attackers to bypass access controls, forge requests, and potentially access sensitive network data without proper credentials.

Technologies: CISA Malcolm. Vendors: CISA.

Quick answers

Is CVE-2026-107336 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107336 being exploited in the wild.
How severe is CVE-2026-107336?: High severity, published 15 October 2026.
Which products and versions are affected?: CISA Malcolm <=26.07.1, <=26.08.0.
Is there a fix for CVE-2026-107336?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-107336 attacked?: It is attacked over the network.
Am I affected by CVE-2026-107336?: Check whether you run CISA Malcolm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerabilities include authentication bypass via spoofing and alternate paths, incorrect authorization checks, server-side request forgery (SSRF), cross-site request forgery (CSRF), and improper handling of compressed data. These flaws affect Malcolm versions ≤26.07.1 and ≤26.08.0, allowing unauthenticated or low-privileged attackers to compromise system integrity and access restricted functionality.

Affected products

CISA Malcolm <=26.07.1, <=26.08.0

Identifiers

CVE-2026-107336
CVE-2026-107334
CVE-2026-107335
CVE-2026-107337
CVE-2026-107361
CVE-2026-107333
CVE-2026-107362

Timeline

2026-10-15: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.