# CVE-2026-107336: CISA Malcolm authentication and authorization flaws

Source: https://junglewise.ai/threats/cve-2026-107336-cisa-malcolm  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-15. Updated: 2026-10-15  
License: CC BY 4.0 with a link back

CVE-2026-107336 · Severity: high · Published 2026-10-15

CISA Malcolm is a network traffic analysis and security monitoring tool used to detect threats in critical infrastructure networks. Multiple authentication, authorization, and request validation flaws allow attackers to bypass access controls, forge requests, and potentially access sensitive network data without proper credentials.

Technologies: [CISA Malcolm](https://junglewise.ai/threats/technologies/malcolm). Vendors: [CISA](https://junglewise.ai/threats/vendors/cisa).

## Quick answers

**Is CVE-2026-107336 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107336 being exploited in the wild.

**How severe is CVE-2026-107336?** High severity, published 15 October 2026.

**Which products and versions are affected?** CISA Malcolm <=26.07.1, <=26.08.0.

**Is there a fix for CVE-2026-107336?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-107336 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-107336?** Check whether you run CISA Malcolm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerabilities include authentication bypass via spoofing and alternate paths, incorrect authorization checks, server-side request forgery (SSRF), cross-site request forgery (CSRF), and improper handling of compressed data. These flaws affect Malcolm versions ≤26.07.1 and ≤26.08.0, allowing unauthenticated or low-privileged attackers to compromise system integrity and access restricted functionality.

## Affected products

- CISA Malcolm <=26.07.1, <=26.08.0

## Identifiers

- CVE-2026-107336
- CVE-2026-107334
- CVE-2026-107335
- CVE-2026-107337
- CVE-2026-107361
- CVE-2026-107333
- CVE-2026-107362

## Timeline

- 2026-10-15: disclosed

## Related threats

- [Malcolm file-upload component SSRF via FilePond fetch API](https://junglewise.ai/threats/cve-2026-107362-the-bundled-filepond-php-server-in-malcolm-s-file-upload)
- [CISA Malcolm archive bomb bypass in single-stream compression](https://junglewise.ai/threats/cve-2026-19671-cisa-malcolm-archive-bomb-bypass-in-single-stream-compression)
- [CISA Malcolm nginx Lua RBAC bypass via percent-encoding](https://junglewise.ai/threats/cve-2026-19670-cisa-malcolm-nginx-lua-rbac-bypass-via-percent-encoding)