High severity · published Sep 11, 2026
CVE-2026-90456
Use of default credentials in Malcolm
8.1
CVSS
0.3%
EPSS
No
On KEV
Description
An example environment-configuration file for a bundled inventory-management component ships with a fixed, publicly-known administrative password. A deployment that copies this example file into active configuration without running the setup routine that regenerates credentials will expose that component's administrative interface to anyone aware of the default value.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 20% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
Malcolm · CISA
before v26.06.0 · source: vendor
Affected product
MA
Malcolm
CISA
More from Malcolm
8.8
CVE-2026-90444
OS Command Injection in Malcolm
8.1
CVE-2026-107333
Incorrect Authorization in Malcolm
7.1
CVE-2026-107337
Cross-Site Request Forgery in Malcolm
7.1
CVE-2026-107362
Server-Side Request Forgery in Malcolm
6.5
CVE-2026-107335
Improper Handling of Highly Compressed Data in Malcolm