Medium severity · published Sep 11, 2026
CVE-2026-90451
Use of Default Credentials in Malcolm
5.9
CVSS
0.3%
EPSS
No
On KEV
Description
An example environment-configuration file ships with a fixed, publicly-known secret value used to sign authentication cookies for a bundled packet-analysis component. A deployment that copies this example file into active configuration without running the setup routine that regenerates the value will use the known default, allowing an attacker aware of the default to forge valid authentication cookies for that component.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 17% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
Malcolm · CISA
before v26.06.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-90451
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-90451
government-resource
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-254-01.json
www.cisa.gov
https://www.cisa.gov/news-events/ics-advisories/icsa-26-254-01
More from Malcolm
8.8
CVE-2026-90444
OS Command Injection in Malcolm
8.1
CVE-2026-107333
Incorrect Authorization in Malcolm
8.1
CVE-2026-90456
Use of default credentials in Malcolm
7.1
CVE-2026-107337
Cross-Site Request Forgery in Malcolm
7.1
CVE-2026-107362
Server-Side Request Forgery in Malcolm
