by Kastro
Paper/Archive/CVE-2026-90456

CVE-2026-90456

CISA Malcolm — Use of default credentials in Malcolm

EPSS 0.3%CVSS 9.2
critical.is priorityof 100
32
CVSS 9.2 (CNA)9.2 / 10 × 3027.6Not in CISA KEV+300.0EPSS percentile 19.6.196 × 203.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An example environment-configuration file for a bundled inventory-management component ships with a fixed, publicly-known administrative password. A deployment that copies this example file into active configuration without running the setup routine that regenerates credentials will expose that component's administrative interface to anyone aware of the default value.

Affected

ProductAffectedFixed inSource
Malcolm< v26.06.0v26.06.0CNA

Scores by source

icscert (CNA)9.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
icscert (CNA)8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisoryraw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-254-01.jsonrefcisa.gov/news-events/ics-advisories/icsa-26-254-01