View CSAF Summary The following versions of CISA Malcolm are affected: Malcolm CVSS Vendor Equipment Vulnerabilities v3 8.8 CISA CISA Malcolm Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Server-Side Request Forgery (SSRF), Authentication Bypass by Spoofing, Missing Authorization,…
Serial Number: AV26-841Date: August 21, 2026 As of August 18, 2026, Malcolm is affected by vulnerabilities in the following product: Malcolm Prior to 26.06.1 (CVE-2026-55676) Prior to 26.07.0 (CVE-2026-63133, CVE-2026-63134, CVE-2026-63177) Prior to or equal to 26.07.1 (CVE-2026-19670, CVE-2026-19671) The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. CISA Malcolm | CISA ICS Advisories | CISA
As federal enforcement tightens and states begin stepping in with their own cybersecurity mandates, water and wastewater utilities face a looming wave of hard compliance deadlines, compounded by recent cyber attacks on state water utilities.Key takeawaysWhile the EPA’s national sanitary-survey mandate stalled in court, the agency is aggressively using existing authority, technical guidance, and enforcement alerts to inspect cyber gaps. Community water systems serving 3,301 to 49,999 people, the…