Vulnerabilities
CISA Malcolm Authentication Bypass via Case-Insensitive Nginx Proxy – CVE-2026-107336
CISA Malcolm versions ≤26.07.1 are vulnerable to authentication bypass through a case‑insensitive Nginx reverse‑proxy rule that forwards unauthenticated requests to the Arkime backend. The flaw allows attackers to forge X‑Forwarded‑User headers and access Arkime data without credentials. Defenders should upgrade to v26.08.0 or apply the vendor patch immediately.
What happened
Malcolm 26.07.1 and earlier contain a mis‑configured Nginx reverse‑proxy rule that matches dashboard URLs with a case‑insensitive regex but rewrites only when the path is all lowercase. Requests with mixed‑case segments bypass the rewrite, are proxied to Arkime without authentication, and forward a client‑supplied X-Forwarded-User header that Arkime trusts as the authenticated username.
Impact
Unauthenticated network actors can reach the Arkime backend, impersonate any user, and retrieve or modify surveillance data. The vulnerability is rated CVSS v3.1 8.1 (High) and is listed under CVE-2026-107336, CVE-2026-107333, CVE-2026-107362, CVE-2026-107361, CVE-2026-107337, CVE-2026-107335, CVE-2026-107334.
Mitigation
The vendor released a fix in Malcolm v26.08.0 that corrects the proxy configuration and removes the unauthenticated location. If an upgrade is not immediately possible, disable the /dashboards/arkime proxy or block the X-Forwarded-User header at the reverse‑proxy level.
What to do
- Verify the running Malcolm version; if ≤26.07.1, plan an upgrade.
- Apply the vendor patch or upgrade to v26.08.0 as soon as possible.
- Audit Nginx configurations for case‑insensitive regexes that forward authentication headers.
- Monitor Arkime logs for unexpected
X-Forwarded-Uservalues or unauthenticated access.
Related vulnerabilities
Ivanti Connect Secure Zero‑Day Exploited in the Wild (CVE‑2026‑104935)
A high‑severity authentication bypass in Ivanti Connect Secure allowed unauthenticated attackers to execute arbitrary commands. The flaw was already exploited before disclosure, prompting CISA to add it to the KEV catalog. Defenders must patch immediately and harden VPN access.
Read briefing
Cisco Catalyst SD‑WAN Manager API Authentication Bypass CVE‑2026‑76504 Exploited in Wild
A critical API authentication bypass (CVE‑2026‑76504) in Cisco Catalyst SD‑WAN Manager has been actively exploited. The flaw allows unauthenticated attackers to gain admin‑level API access via malformed URL encoding. Defenders should patch immediately and scan for signs of exploitation.
Read briefing
OpenOffice Versions <4.1.17 Vulnerable to Remote Code Execution (CVE‑2026‑59265, CVE‑2026‑63277)
Multiple CVEs have been identified in OpenOffice versions older than 4.1.17 that enable remote code execution. The flaws allow an attacker to trigger arbitrary code on a target system via crafted documents. Defenders must apply the vendor’s patches immediately or upgrade to a supported release.
Read briefing
Schneider Electric PowerChute Serial Shutdown Vulnerability (CVE‑2026‑13348) – Immediate Patch Required
Schneider Electric’s PowerChute Serial Shutdown UPS management software is affected by a CVE‑2026‑13348 flaw that allows unlimited authentication attempts when redirect handling is disabled. The issue could enable attackers to bypass login controls and disrupt critical infrastructure operations. Versions up to 1.5 and 1.6 are impacted; the vendor’s v1.6 patch restores proper authentication limits. Operators must download and install the update for Windows and Linux immediately, then verify the new version via the Control Panel or PCSS About page.
Read briefing